Royal Addons for Elementor – Addons and Templates Kit for Elementor vulnerabilities
10 known vulnerabilities in Royal Addons for Elementor – Addons and Templates Kit for Elementor from Wproyal. 10 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
Royal Addons for Elementor – Addons and…: Server-Side Request Forgery
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhook_url' setting. The widget's render() method persists the attacker-controlled URL into
- 7.2 High severity
Royal Addons for Elementor – Addons and…: Improper Neutralization of Input During Web Page Generation
The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in the wpr_update_form_action_meta AJAX action in all versions up to, and including, 1.7.1056. This is due to insufficient input sanitizatio
- 7.2 High severity
Royal Addons for Elementor – Addons and…: Server-Side Request Forgery
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function, which can be bypassed by in
- 8.8 High severity
Royal Addons for Elementor – Addons and…: Unrestricted Upload of File with Dangerous Type
The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a name to bypa
- 8.8 High severity
Royal Addons for Elementor – Addons and…: Cross-Site Request Forgery
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1007. This is due to missing or incorrect nonce validation on the 'wpr_filter_woo_products' function. This makes
- 9.8 Critical severity
Royal Addons for Elementor – Addons and…: Unrestricted Upload of File with Dangerous Type
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in the 'file_validity' function in all versions up to, and including, 1.3.94. This makes it possible for unauthenticated att
- 8.1 High severity
Royal Addons for Elementor – Addons and…: Improper Access Control
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permi
- 8.1 High severity
Royal Addons for Elementor – Addons and…: Improper Access Control
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level perm
- 8.8 High severity
Royal Addons for Elementor – Addons and…: Improper Authorization
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level
- 8.8 High severity
Royal Addons for Elementor – Addons and…: Improper Access Control
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level pe