PLUGIN SECURITY
Is Royal Elementor Addons safe?
Elementor templates, Header footer builder, Elementor Post Grid, Woocommerce Grid builder, Slider, Forms, Gallery, Nav menu addons, Elementor widgets.
What this plugin does
- Slug:
royal-elementor-addons - Author: WP Royal
- 600000+ active installs
- 96/100 rating (611 reviews on wordpress.org)
- 19809049 all-time downloads
- On WordPress.org since 2021-06-07
elementorelementor addonselementor templateselementor widgetsheader footer builder
Maintenance status
- Latest known version: 1.7.1065
- Last updated: 2026-08-17 6:52am GMT
- Tested up to WordPress: 7.0.4
- Requires PHP: 5.6+
Known vulnerabilities
85 known CVEs on file for Royal Elementor Addons.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-13406 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1066 | Missing Authorization | Unknown | < 1.7.1066 | 1.7.1066 | 2026-08-26 | ⚠ update needed |
| CVE-2026-13404 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1066 | Authorization Bypass Through User-Controlled Key | Unknown | < 1.7.1066 | 1.7.1066 | 2026-08-26 | ⚠ update needed |
| CVE-2026-19226 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1066 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 1.7.1066 | 1.7.1066 | 2026-08-26 | ⚠ update needed |
| CVE-2026-13405 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1066 | Improper Control of Generation of Code ('Code Injection') | Unknown | < 1.7.1066 | 1.7.1066 | 2026-08-20 | ⚠ update needed |
| CVE-2026-17123 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1065 | Server-Side Request Forgery (SSRF) | High 8.8 | < 1.7.1065 | 1.7.1065 | 2026-08-15 | ✓ fixed in latest |
| CVE-2026-19217 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1065 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 1.7.1065 | 1.7.1065 | 2026-08-10 | ✓ fixed in latest |
| CVE-2026-13402 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1063 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 1.7.1063 | 1.7.1063 | 2026-06-26 | ✓ fixed in latest |
| CVE-2026-8118 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1060 | External Control of File Name or Path | Medium 6.5 | < 1.7.1060 | 1.7.1060 | 2026-06-18 | ✓ fixed in latest |
+ 90 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-6504 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1059 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 1.7.1059 | 1.7.1059 | 2026-05-13 | ✓ fixed in latest |
| CVE-2026-27421 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1053 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 1.7.1053 | 1.7.1053 | 2026-05-07 | ✓ fixed in latest |
| CVE-2026-25436 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1053 | Missing Authorization | Medium 5.3 | < 1.7.1053 | 1.7.1053 | 2026-05-07 | ✓ fixed in latest |
| CVE-2026-5159 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1057 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 1.7.1057 | 1.7.1057 | 2026-05-04 | ✓ fixed in latest |
| CVE-2026-4803 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1057 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 1.7.1057 | 1.7.1057 | 2026-05-04 | ✓ fixed in latest |
| CVE-2026-6229 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1058 | Server-Side Request Forgery (SSRF) | High 7.2 | < 1.7.1058 | 1.7.1058 | 2026-05-01 | ✓ fixed in latest |
| CVE-2026-4024 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1057 | Missing Authorization | Medium 5.3 | < 1.7.1057 | 1.7.1057 | 2026-05-01 | ✓ fixed in latest |
| CVE-2026-5428 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1057 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 1.7.1057 | 1.7.1057 | 2026-04-23 | ✓ fixed in latest |
| CVE-2026-5162 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1057 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 1.7.1057 | 1.7.1057 | 2026-04-16 | ✓ fixed in latest |
| CVE-2026-40763 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1057 | — | Medium 5.3 | < 1.7.1057 | 1.7.1057 | 2026-03-31 | ✓ fixed in latest |
| CVE-2025-13067 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1050 | Unrestricted Upload of File with Dangerous Type | High 8.8 | < 1.7.1050 | 1.7.1050 | 2026-03-10 | ✓ fixed in latest |
| CVE-2026-28135 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1053 | Inclusion of Functionality from Untrusted Control Sphere | High 8.2 | < 1.7.1053 | 1.7.1053 | 2026-02-26 | ✓ fixed in latest |
| CVE-2025-11363 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1037 | Unrestricted Upload of File with Dangerous Type | Medium 5.3 | < 1.7.1037 | 1.7.1037 | 2025-11-24 | ✓ fixed in latest |
| CVE-2025-39361 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1018 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 1.7.1018 | 1.7.1018 | 2025-05-07 | ✓ fixed in latest |
| CVE-2024-12120 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1018 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.7.1018 | 1.7.1018 | 2025-05-06 | ✓ fixed in latest |
| CVE-2025-39543 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.979 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 1.3.979 | 1.3.979 | 2025-04-16 | ✓ fixed in latest |
| CVE-2025-26990 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1007 | Server-Side Request Forgery (SSRF) | Medium 4.4 | < 1.7.1007 | 1.7.1007 | 2025-04-11 | ✓ fixed in latest |
| CVE-2024-56226 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1002 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 1.7.1002 | 1.7.1002 | 2024-12-19 | ✓ fixed in latest |
| CVE-2024-56227 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1002 | Missing Authorization | Medium 4.3 | < 1.7.1002 | 1.7.1002 | 2024-12-19 | ✓ fixed in latest |
| CVE-2024-56062 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 1.7.1 | 1.7.1 | 2024-12-18 | ✓ fixed in latest |
| CVE-2024-10798 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1004 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 1.7.1004 | 1.7.1004 | 2024-11-27 | ✓ fixed in latest |
| CVE-2024-9668 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1002 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.7.1002 | 1.7.1002 | 2024-11-12 | ✓ fixed in latest |
| CVE-2024-9682 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1002 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.7.1002 | 1.7.1002 | 2024-11-12 | ✓ fixed in latest |
| CVE-2024-9059 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1002 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.7.1002 | 1.7.1002 | 2024-11-12 | ✓ fixed in latest |
| CVE-2024-50442 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.981 | Improper Restriction of XML External Entity Reference | Medium 6.5 | < 1.3.981 | 1.3.981 | 2024-10-24 | ✓ fixed in latest |
| CVE-2024-7417 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.987 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 4.3 | < 1.3.987 | 1.3.987 | 2024-10-16 | ✓ fixed in latest |
| CVE-2024-8482 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.987 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 1.3.987 | 1.3.987 | 2024-10-07 | ✓ fixed in latest |
| CVE-2024-44001 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.985 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 1.3.985 | 1.3.985 | 2024-08-29 | ✓ fixed in latest |
| CVE-2024-5818 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.981 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.3.981 | 1.3.981 | 2024-07-23 | ✓ fixed in latest |
| CVE-2024-4488 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.977 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.3.977 | 1.3.977 | 2024-06-06 | ✓ fixed in latest |
| CVE-2024-4489 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.977 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.3.977 | 1.3.977 | 2024-06-06 | ✓ fixed in latest |
| CVE-2024-4342 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.976 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.3.976 | 1.3.976 | 2024-05-31 | ✓ fixed in latest |
| CVE-2024-4087 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.976 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.3.976 | 1.3.976 | 2024-05-31 | ✓ fixed in latest |
| CVE-2024-3887 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.975 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.3.975 | 1.3.975 | 2024-05-15 | ✓ fixed in latest |
| CVE-2024-3889 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.972 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 1.3.972 | 1.3.972 | 2024-04-22 | ✓ fixed in latest |
| CVE-2024-2799 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.972 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 1.3.972 | 1.3.972 | 2024-04-22 | ✓ fixed in latest |
| CVE-2024-2798 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.972 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 1.3.972 | 1.3.972 | 2024-04-22 | ✓ fixed in latest |
| CVE-2024-3675 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.972 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 1.3.972 | 1.3.972 | 2024-04-22 | ✓ fixed in latest |
| CVE-2024-32786 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.95 | Authentication Bypass by Spoofing | Critical 9.8 | < 1.3.95 | 1.3.95 | 2024-04-22 | ✓ fixed in latest |
| CVE-2024-1567 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.95 | Unrestricted Upload of File with Dangerous Type | Critical 9.8 | < 1.3.95 | 1.3.95 | 2024-04-19 | ✓ fixed in latest |
| CVE-2024-31236 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.95 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.3.95 | 1.3.95 | 2024-04-05 | ✓ fixed in latest |
| CVE-2024-1500 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.92 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.3.92 | 1.3.92 | 2024-03-06 | ✓ fixed in latest |
| CVE-2024-0442 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.88 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 1.3.88 | 1.3.88 | 2024-02-08 | ✓ fixed in latest |
| CVE-2024-0511 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.88 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 1.3.88 | 1.3.88 | 2024-02-07 | ✓ fixed in latest |
| CVE-2024-0512 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.88 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 1.3.88 | 1.3.88 | 2024-02-07 | ✓ fixed in latest |
| CVE-2024-0516 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.88 | Cross-Site Request Forgery (CSRF) | Medium 5.3 | < 1.3.88 | 1.3.88 | 2024-02-07 | ✓ fixed in latest |
| CVE-2024-0514, CVE-2024-0515, CVE-2024-0513, CVE-2024-0512, CVE-2024-0511 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.88 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 1.3.88 | 1.3.88 | 2024-02-07 | ✓ fixed in latest |
| CVE-2024-0513 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.88 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 1.3.88 | 1.3.88 | 2024-02-07 | ✓ fixed in latest |
| CVE-2024-0515 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.88 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 1.3.88 | 1.3.88 | 2024-02-07 | ✓ fixed in latest |
| CVE-2023-5922 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.81 | Authorization Bypass Through User-Controlled Key | High 7.5 | < 1.3.81 | 1.3.81 | 2023-12-06 | ✓ fixed in latest |
| CVE-2023-5360 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.79 | Unrestricted Upload of File with Dangerous Type | Critical 9.8 | < 1.7.1 | 1.7.1 | 2023-10-09 | ✓ fixed in latest |
| CVE-2022-47175 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] <= 1.3.75 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 1.3.75 | 1.3.75 | 2023-08-22 | ✓ fixed in latest |
| CVE-2023-33999 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.71 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 1.3.71 | 1.3.71 | 2023-07-18 | ✓ fixed in latest |
| CVE-2023-3709 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.71 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 1.3.71 | 1.3.71 | 2023-07-17 | ✓ fixed in latest |
| CVE-2022-4710 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.60 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.3.60 | 1.3.60 | 2023-01-10 | ✓ fixed in latest |
| CVE-2022-4704 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.60 | Improper Access Control | High 8.1 | < 1.3.60 | 1.3.60 | 2023-01-10 | ✓ fixed in latest |
| CVE-2022-4703 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.60 | Improper Access Control | High 8.1 | < 1.3.60 | 1.3.60 | 2023-01-10 | ✓ fixed in latest |
| CVE-2022-4709 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.60 | Improper Access Control | Medium 6.5 | < 1.3.60 | 1.3.60 | 2023-01-10 | ✓ fixed in latest |
| CVE-2022-4707 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.60 | Cross-Site Request Forgery (CSRF) | Medium 6.5 | < 1.3.60 | 1.3.60 | 2023-01-10 | ✓ fixed in latest |
| CVE-2022-4708 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.60 | Improper Access Control | Medium 6.5 | < 1.3.60 | 1.3.60 | 2023-01-10 | ✓ fixed in latest |
| CVE-2022-4705 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.60 | Improper Access Control | Medium 4.3 | < 1.3.60 | 1.3.60 | 2023-01-10 | ✓ fixed in latest |
| CVE-2022-4702 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.60 | Improper Access Control | Medium 6.5 | < 1.3.60 | 1.3.60 | 2023-01-10 | ✓ fixed in latest |
| CVE-2022-4701 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.60 | Improper Authorization | High 8.8 | < 1.3.60 | 1.3.60 | 2023-01-10 | ✓ fixed in latest |
| CVE-2022-4711 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.60 | Improper Access Control | Medium 4.3 | < 1.3.60 | 1.3.60 | 2023-01-10 | ✓ fixed in latest |
| CVE-2022-4700 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.60 | Improper Access Control | High 8.8 | < 1.3.60 | 1.3.60 | 2023-01-10 | ✓ fixed in latest |
| CVE-2022-4102 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.56 | Cross-Site Request Forgery (CSRF) | Low 3.1 | < 1.3.56 | 1.3.56 | 2022-12-15 | ✓ fixed in latest |
| CVE-2022-4103 | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.56 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 1.3.56 | 1.3.56 | 2022-12-15 | ✓ fixed in latest |
| — | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.56 | — | Unknown | < 1.3.56 | 1.3.56 | 2022-12-06 | ✓ fixed in latest |
| — | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.3.33 | Missing Authorization | Medium 6.3 | < 1.3.33 | 1.3.33 | 2022-03-04 | ✓ fixed in latest |
| — | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1007 | Cross-Site Request Forgery (CSRF) | Medium 6.1 | < 1.7.1007 | 1.7.1007 | 0000-00-00 | ✓ fixed in latest |
| — | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1008 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 1.7.1008 | 1.7.1008 | 0000-00-00 | ✓ fixed in latest |
| — | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1013 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.7.1013 | 1.7.1013 | 0000-00-00 | ✓ fixed in latest |
| — | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1013 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.7.1013 | 1.7.1013 | 0000-00-00 | ✓ fixed in latest |
| — | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1021 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.7.1021 | 1.7.1021 | 0000-00-00 | ✓ fixed in latest |
| — | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1029 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.7.1029 | 1.7.1029 | 0000-00-00 | ✓ fixed in latest |
| — | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1050 | — | Unknown | < 1.7.1050 | 1.7.1050 | 0000-00-00 | ✓ fixed in latest |
| — | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1050 | — | Unknown | < 1.7.1050 | 1.7.1050 | 0000-00-00 | ✓ fixed in latest |
| — | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1037 | — | Unknown | < 1.7.1037 | 1.7.1037 | 0000-00-00 | ✓ fixed in latest |
| — | Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1032 | — | Unknown | < 1.7.1032 | 1.7.1032 | 0000-00-00 | ✓ fixed in latest |
| — | Unauthorised AJAX Calls via Freemius | — | Unknown | < 1.3.33 | 1.3.33 | — | ✓ fixed in latest |
| CVE-2025-0393 | Royal Elementor Addons and Templates < 1.7.1007 - Stored XSS via CSRF | — | Unknown | < 1.7.1007 | 1.7.1007 | — | ✓ fixed in latest |
| CVE-2025-1441 | Royal Elementor Addons and Templates < 1.7.1008 - Reflected XSS | — | Unknown | < 1.7.1008 | 1.7.1008 | — | ✓ fixed in latest |
| CVE-2025-1455 | Royal Elementor Addons and Templates < 1.7.1013 - Contributor+ Stored XSS | — | Unknown | < 1.7.1013 | 1.7.1013 | — | ✓ fixed in latest |
| CVE-2025-1456 | Royal Elementor Addons and Templates < 1.7.1013 - Contributor+ DOM-Based Stored XSS | — | Unknown | < 1.7.1013 | 1.7.1013 | — | ✓ fixed in latest |
| CVE-2025-3813 | Royal Elementor Addons and Templates < 1.7.1021 - Contributor+ Stored XSS | — | Unknown | < 1.7.1021 | 1.7.1021 | — | ✓ fixed in latest |
| CVE-2025-5338 | Royal Elementor Addons < 1.7.1025 - Contributor+ Stored DOM-Based XSS via Multiple Widgets | — | Unknown | < 1.7.1025 | 1.7.1025 | — | ✓ fixed in latest |
| CVE-2025-6251 | Royal Elementor Addons and Templates < 1.7.1037 - Contributor+ Stored XSS | — | Unknown | < 1.7.1037 | 1.7.1037 | — | ✓ fixed in latest |
| CVE-2025-5092 | Multiple Plugins and Themes - Contributor+ DOM-Based Stored XSS via lightGallery Library | — | Unknown | < 1.7.1032 | 1.7.1032 | — | ✓ fixed in latest |
| CVE-2026-2373 | Royal Addons for Elementor < 1.7.1050 - Unauthenticated Custom Post Type Contents Exposure | — | Unknown | < 1.7.1050 | 1.7.1050 | — | ✓ fixed in latest |
| CVE-2026-0664 | Royal Elementor Addons < 1.7.1050 - Contributor+ Stored XSS via REST API Meta Bypass | — | Unknown | < 1.7.1050 | 1.7.1050 | — | ✓ fixed in latest |
How to fix it
Keep Royal Elementor Addons updated — 1.7.1065 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Elementor Website Builder – more than just a page builder — 10000000+ active installs — 90/100 (7297)
- Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder — 2000000+ active installs — 98/100 (2525) — max PHP 8.4
- Essential Addons for Elementor – Popular Elementor Templates & Widgets — 1000000+ active installs — 98/100 (4115) — max PHP 8.4
- Starter Templates – AI-Powered Templates for Elementor & Gutenberg — 1000000+ active installs — 98/100 (4745) — max PHP 8.4
- ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor — 1000000+ active installs — 98/100 (2037) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.