WordPress royal-elementor-addons has 48 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2023-5360 | The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthe | critical | 9.8 | <1.3.79 | 1.3.79 |
| CVE-2024-1567 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in t | high | 8.2 | <1.3.95 | 1.3.95 |
| CVE-2022-4703 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action | medium | 4.3 | <=1.3.59 | – |
| CVE-2022-4700 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX actio | medium | 5.4 | <=1.3.59 | – |
| CVE-2022-4702 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX actio | medium | 5.4 | <=1.3.59 | – |
| CVE-2022-4704 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action i | medium | 5.4 | <=1.3.59 | – |
| CVE-2022-4701 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX act | medium | 4.3 | <=1.3.59 | – |
| CVE-2022-4710 | The Royal Elementor Addons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.59, du | medium | 6.1 | <=1.3.59 | – |
| CVE-2023-5922 | The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and R | high | 7.5 | <1.3.81 | 1.3.81 |
| CVE-2022-4711 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX actio | medium | 4.3 | <1.3.60 | 1.3.60 |
| CVE-2022-4705 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action i | medium | 4.3 | <=1.3.59 | – |
| CVE-2022-4708 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX acti | medium | 4.3 | <=1.3.59 | – |
| CVE-2022-4709 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX actio | medium | 4.3 | <=1.3.59 | – |
| CVE-2024-3675 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Flip Carousel, F | medium | 6.4 | <1.3.972 | 1.3.972 |
| CVE-2023-3709 | The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 1.3.70 | medium | 5.3 | <=1.3.70 | – |
| CVE-2024-0442 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via element URL parameters in all | medium | 6.4 | <1.3.88 | 1.3.88 |
| CVE-2024-8482 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all ve | medium | 6.4 | <1.3.987 | 1.3.987 |
| CVE-2024-1500 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Logo Widget in all versio | medium | 5.4 | <1.3.92 | 1.3.92 |
| CVE-2024-9682 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Form Builder wid | medium | 6.4 | <1.7.1002 | 1.7.1002 |
| CVE-2024-2799 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid & Advanced Tex | medium | 6.4 | <1.3.97 | 1.3.97 |
| CVE-2024-9059 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget in all | medium | 6.4 | <1.7.1002 | 1.7.1002 |
| CVE-2024-9668 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget | medium | 6.4 | <1.7.1002 | 1.7.1002 |
| CVE-2024-7417 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1. | medium | 4.3 | <=1.3.986 | – |
| CVE-2024-10798 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1. | medium | 4.3 | <=1.7.1003 | – |
| CVE-2022-4707 | The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This i | medium | 4.3 | <=1.3.59 | – |
| CVE-2024-4342 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image hotspot, i | medium | 6.4 | <1.3.976 | 1.3.976 |
| CVE-2024-2798 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget container | medium | 6.4 | <1.3.972 | 1.3.972 |
| CVE-2024-3889 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Accordi | medium | 6.4 | <1.3.972 | 1.3.972 |
| CVE-2024-4087 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Back to Top widg | medium | 6.4 | <1.3.976 | 1.3.976 |
| CVE-2024-4488 | The Royal Elementor Addons and Templates for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘inline_list’ parameter in versi | medium | 6.4 | <1.3.977 | 1.3.977 |
| CVE-2024-4489 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_upload_mimes’ fun | medium | 6.4 | <1.3.977 | 1.3.977 |
| CVE-2025-1455 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Woo Grid widget in all ve | medium | 6.4 | <1.7.1013 | 1.7.1013 |
| CVE-2025-1456 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widgetGrid`, `widgetCoun | medium | 6.4 | <1.7.1013 | 1.7.1013 |
| CVE-2024-3887 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Form Builder widget in al | medium | 5.4 | <1.3.975 | 1.3.975 |
| CVE-2024-12120 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown widget display_ | medium | 5.4 | <1.7.1018 | 1.7.1018 |
| CVE-2025-3813 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_elementor_data’ paramet | medium | 6.4 | <1.7.1021 | 1.7.1021 |
| CVE-2022-4103 | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not | medium | 4.3 | <1.3.56 | 1.3.56 |
| CVE-2024-5818 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored DOM-based Cross-Site Scripting via the plugin's Magazi | medium | 6.4 | <1.3.981 | 1.3.981 |
| CVE-2022-4102 | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not | low | 3.1 | <1.3.56 | 1.3.56 |
| CVE-2025-5338 | The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and | medium | 6.4 | <1.7.1025 | 1.7.1025 |
| CVE-2024-0514 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | <1.3.88 | 1.3.88 |
| CVE-2025-0393 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 6.1 | <=1.7.1006 | – |
| CVE-2024-0512 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | <1.3.88 | 1.3.88 |
| CVE-2024-0516 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability | medium | 5.3 | <1.3.88 | 1.3.88 |
| CVE-2025-1441 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 6.1 | <=1.7.1007 | – |
| CVE-2024-0513 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | <1.3.88 | 1.3.88 |
| CVE-2024-0515 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | <1.3.88 | 1.3.88 |
| CVE-2024-0511 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | <1.3.88 | 1.3.88 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked