Now officially on WordPress.org

CVE Database / CVE-2026-6229

CVE · High

CVE-2026-6229 — Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1058

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-6229 Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1058 Server-Side Request Forgery (SSRF) High 7.2 < 1.7.1058 1.7.1058 2026-05-01 —

CVE-2026-6229

The Royal Elementor Addons plugin for WordPress has a vulnerability that allows attackers to trick the plugin into making unauthorized requests to external URLs. Specifically, the plugin does not properly validate URLs passed to it, allowing attackers to include internal or private network addresses in the requests. This can be exploited by attackers with Contributor-level access or higher, enabling them to retrieve sensitive information from internal services.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings