Plugin icon

Royal Addons for Elementor – Addons and Templates Kit for Elementor

royal-elementor-addons

Vulnerabilities:

60

Last Updated:

January 5, 2026

Active Installs:

600000

Published
Title
Fixed in
CVSS
Published
2025-11-24
Title
Royal Elementor Addons and Templates < 1.7.1037 - Unauthenticated Media File Upload
Fixed in
Fixed in 1.7.1037
CVSS
5.3 (medium)
Published
2025-11-19
Title
Multiple Plugins and Themes - Contributor+ DOM-Based Stored XSS via lightGallery Library
Fixed in
Fixed in 1.7.1032
CVSS
6.4 (medium)
Published
2025-11-18
Title
Royal Elementor Addons and Templates < 1.7.1037 - Contributor+ Stored XSS
Fixed in
Fixed in 1.7.1037
CVSS
5.9 (medium)
Published
2025-06-25
Title
Royal Elementor Addons < 1.7.1025 - Contributor+ Stored DOM-Based XSS via Multiple Widgets
Fixed in
Fixed in 1.7.1025
CVSS
5.9 (medium)
Published
2025-05-30
Title
Royal Elementor Addons and Templates < 1.7.1021 - Contributor+ Stored XSS
Fixed in
Fixed in 1.7.1021
CVSS
5.9 (medium)
Published
2025-05-07
Title
Royal Elementor Addons < 1.7.1018 - Contributor+ Stored XSS
Fixed in
Fixed in 1.7.1018
CVSS
5.9 (medium)
Published
2025-05-06
Title
Royal Elementor Addons and Templates < 1.7.1018 - Contributor+ Stored XSS
Fixed in
Fixed in 1.7.1018
CVSS
5.9 (medium)
Published
2025-04-16
Title
Royal Elementor Addons < 1.3.979 - Contributor+ Stored XSS
Fixed in
Fixed in 1.3.979
CVSS
5.9 (medium)
Published
2025-04-11
Title
Royal Elementor Addons and Templates < 1.7.1013 - Contributor+ Stored XSS
Fixed in
Fixed in 1.7.1013
CVSS
5.9 (medium)
Published
2025-04-11
Title
Royal Elementor Addons < 1.7.1007 - Admin+ SSRF
Fixed in
Fixed in 1.7.1007
CVSS
3.8 (low)
Published
2025-04-11
Title
Royal Elementor Addons and Templates < 1.7.1013 - Contributor+ DOM-Based Stored XSS
Fixed in
Fixed in 1.7.1013
CVSS
5.9 (medium)
Published
2025-02-18
Title
Royal Elementor Addons and Templates < 1.7.1008 - Reflected XSS
Fixed in
Fixed in 1.7.1008
CVSS
7.1 (high)
Published
2025-01-13
Title
Royal Elementor Addons and Templates < 1.7.1007 - Stored XSS via CSRF
Fixed in
Fixed in 1.7.1007
CVSS
7.1 (high)
Published
2024-12-19
Title
Royal Elementor Addons < 1.7.1002 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.7.1002
CVSS
7.1 (high)
Published
2024-12-19
Title
Royal Elementor Addons < 1.7.1002 - Missing Authorization
Fixed in
Fixed in 1.7.1002
CVSS
2.7 (low)
Published
2024-12-18
Title
Royal Elementor Addons < 1.7.1 - Contributor+ Stored XSS
Fixed in
Fixed in 1.7.1
CVSS
5.9 (medium)
Published
2024-11-27
Title
Royal Elementor Addons and Templates < 1.7.1004 - Authenticated (Contributor+) Post Disclosure
Fixed in
Fixed in 1.7.1004
CVSS
4.3 (medium)
Published
2024-11-12
Title
Royal Elementor Addons and Template < 1.7.1002 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget
Fixed in
Fixed in 1.7.1002
CVSS
6.4 (medium)
Published
2024-11-12
Title
Royal Elementor Addons and Templates < 1.7.1002 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget
Fixed in
Fixed in 1.7.1002
CVSS
6.4 (medium)
Published
2024-11-12
Title
Royal Elementor Addons and Templates < 1.7.1002 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
Fixed in
Fixed in 1.7.1002
CVSS
6.4 (medium)
Published
2024-10-24
Title
Royal Elementor Addons < 1.3.981 - Authenticated (Author+) External Entity Injection
Fixed in
Fixed in 1.3.981
CVSS
5.4 (medium)
Published
2024-10-16
Title
Royal Elementor Addons and Templates < 1.3.987 - Authenticated (Subscriber+) Private Post Disclosure
Fixed in
Fixed in 1.3.987
CVSS
4.3 (medium)
Published
2024-10-07
Title
Royal Elementor Addons and Templates < 1.3.987 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget
Fixed in
Fixed in 1.3.987
CVSS
6.4 (medium)
Published
2024-08-29
Title
Royal Elementor Addons < 1.3.985 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.3.985
CVSS
6.4 (medium)
Published
2024-07-23
Title
Royal Elementor Addons and Templates < 1.3.981 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider Widget
Fixed in
Fixed in 1.3.981
CVSS
6.4 (medium)
Published
2024-06-06
Title
Royal Elementor Addons and Templates < 1.3.977 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploads
Fixed in
Fixed in 1.3.977
CVSS
6.4 (medium)
Published
2024-06-06
Title
Royal Elementor Addons and Templates < 1.3.977 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.3.977
CVSS
6.4 (medium)
Published
2024-05-31
Title
Royal Elementor Addons and Templates < 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scripting via Back to Top Widget
Fixed in
Fixed in 1.3.976
CVSS
6.4 (medium)
Published
2024-05-31
Title
Royal Elementor Addons and Templates < 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.3.976
CVSS
6.4 (medium)
Published
2024-05-15
Title
Royal Elementor Addons and Templates < 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Builder Widget
Fixed in
Fixed in 1.3.975
CVSS
5.4 (medium)
Published
2024-04-22
Title
Royal Elementor Addons and Templates < 1.3.972 - Contributor+ Stored Cross-Site Scripting via HTML Tags
Fixed in
Fixed in 1.3.972
CVSS
6.4 (medium)
Published
2024-04-22
Title
Royal Elementor Addons < 1.3.95 - Unauthenticated IP Spoofing
Fixed in
Fixed in 1.3.95
CVSS
5.3 (medium)
Published
2024-04-22
Title
Royal Elementor Addons and Templates < 1.3.972 - Contributor+ DOM-Based Stored Cross-Site Scripting
Fixed in
Fixed in 1.3.972
CVSS
6.5 (medium)
Published
2024-04-22
Title
Royal Elementor Addons and Templates < 1.3.972 - Contributor+ Stored Cross-Site Scripting via Flip Carousel, Flip Box, Post Grid, and Taxonomy List Widget Attributes
Fixed in
Fixed in 1.3.972
CVSS
6.4 (medium)
Published
2024-04-22
Title
Royal Elementor Addons and Templates < 1.3.972 - Contributor+ Stored Cross-Site Scripting via Advanced Accordion Title Tags
Fixed in
Fixed in 1.3.972
CVSS
6.4 (medium)
Published
2024-04-19
Title
Royal Elementor Addons and Templates < 1.3.95 - Unauthenticated Limited File Upload
Fixed in
Fixed in 1.3.95
CVSS
8.2 (high)
Published
2024-04-05
Title
Royal Elementor Addons < 1.3.95 - Contributor+ Stored Cross-Site Scriting
Fixed in
Fixed in 1.3.95
CVSS
6.4 (medium)
Published
2024-03-06
Title
Royal Elementor Addons and Templates < 1.3.92 - Authenticated (Contributor+) Stored Cross-Site Scripting via Logo Widget
Fixed in
Fixed in 1.3.92
CVSS
5.4 (medium)
Published
2024-02-08
Title
Royal Elementor Addons and Templates < 1.3.88 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.3.88
CVSS
5.5 (medium)
Published
2024-02-07
Title
Royal Elementor Addons and Templates < 1.3.88 - Multiple Cross-Site Request Forgery
Fixed in
Fixed in 1.3.88
CVSS
4.3 (medium)
Published
2024-02-07
Title
Royal Elementor Addons and Templates < 1.3.88 - Missing Authorization via wpr_update_form_action_meta
Fixed in
Fixed in 1.3.88
CVSS
5.3 (medium)
Published
2023-12-06
Title
Royal Elementor Addons and Templates < 1.3.81 - Unauthenticated Arbitrary Post Read
Fixed in
Fixed in 1.3.81
CVSS
5.3 (medium)
Published
2023-10-09
Title
Royal Elementor Addons and Templates 1.4.78 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 1.7.1
CVSS
10.0 (critical)
Published
2023-10-09
Title
Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 1.3.79
CVSS
10.0 (critical)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.3.71
CVSS
6.1 (medium)
Published
2023-07-17
Title
Royal Elementor Addons < 1.3.71 - Unauthenticated API Key Disclosure
Fixed in
Fixed in 1.3.71
CVSS
5.3 (medium)
Published
2023-01-10
Title
Royal Elementor Addons < 1.3.60 - Subscriber+ Arbitrary Theme Activation
Fixed in
Fixed in 1.3.60
CVSS
5.4 (medium)
Published
2023-01-10
Title
Royal Elementor Addons < 1.3.60 - Menu Template Creation via CSRF
Fixed in
Fixed in 1.3.60
CVSS
4.3 (medium)
Published
2023-01-10
Title
Royal Elementor Addons < 1.3.60 - Subscriber+ Arbitrary Template Import
Fixed in
Fixed in 1.3.60
CVSS
4.3 (medium)
Published
2023-01-10
Title
Royal Elementor Addons < 1.3.60 - Subscriber+ Mega Menu Settings Update
Fixed in
Fixed in 1.3.60
CVSS
4.3 (medium)
Published
2023-01-10
Title
Royal Elementor Addons < 1.3.60 - Subscriber+ Arbitrary Import Deletion
Fixed in
Fixed in 1.3.60
CVSS
4.3 (medium)
Published
2023-01-10
Title
Royal Elementor Addons < 1.3.60 - Subscriber+ Arbitrary Plugin Deactivation
Fixed in
Fixed in 1.3.60
CVSS
5.4 (medium)
Published
2023-01-10
Title
Royal Elementor Addons < 1.3.60 - Reflected XSS
Fixed in
Fixed in 1.3.60
CVSS
7.5 (high)
Published
2023-01-10
Title
Royal Elementor Addons < 1.3.60 - Subscriber+ Template Kit Import
Fixed in
Fixed in 1.3.60
CVSS
4.3 (medium)
Published
2023-01-10
Title
Royal Elementor Addons < 1.3.60 - Subscriber+ Template Condition Update
Fixed in
Fixed in 1.3.60
CVSS
4.3 (medium)
Published
2023-01-10
Title
Royal Elementor Addons < 1.3.60 - Subscriber+ Arbitrary Template Activation
Fixed in
Fixed in 1.3.60
CVSS
4.3 (medium)
Published
2023-01-10
Title
Royal Elementor Addons < 1.3.60 - Subscriber+ Arbitrary Plugin Activation
Fixed in
Fixed in 1.3.60
CVSS
4.3 (medium)
Published
2022-12-15
Title
Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post Creation
Fixed in
Fixed in 1.3.56
CVSS
4.3 (medium)
Published
2022-12-15
Title
Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post Deletion
Fixed in
Fixed in 1.3.56
CVSS
7.1 (high)
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Fixed in
Fixed in 1.3.33
CVSS
4.3 (medium)