CVE-2026-17585Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter Exploitation status Not confirmed Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 09/12/2026 Severity Medium CVE-2026-17123Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 08/16/2026 Severity High CVE-2026-8118Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 06/19/2026 Severity Medium CVE-2026-6504Royal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 05/14/2026 Severity Medium CVE-2026-25436WordPress Royal Elementor Addons plugin < 1.7.1053 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product R Royal Elementor Addons Published 05/07/2026 Severity Medium CVE-2026-27421WordPress Royal Elementor Addons plugin < 1.7.1053 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product R Royal Elementor Addons Published 05/07/2026 Severity Medium CVE-2026-5159Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 05/05/2026 Severity Medium CVE-2026-4803Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 05/05/2026 Severity High CVE-2026-4024Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 05/02/2026 Severity Medium CVE-2026-6229Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 05/02/2026 Severity High CVE-2026-5428Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 04/24/2026 Severity Medium CVE-2026-5162Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 04/17/2026 Severity Medium CVE-2026-4305Royal WordPress Backup & Restore Plugin <= 1.0.16 - Reflected Cross-Site Scripting via 'wpr_pending_template' Parameter Exploitation status Not known exploited Fix Affected product R Royal WordPress Backup, Restore & Migration Plugin – Backup WordPress Sites Safely Published 04/10/2026 Severity Medium CVE-2026-39627WordPress Ashe theme <= 2.266 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product A Ashe Published 04/08/2026 Severity Medium CVE-2026-0664Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 04/04/2026 Severity Medium CVE-2026-24382WordPress News Magazine X theme <= 1.2.50 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product N News Magazine X Published 03/25/2026 Severity High CVE-2026-2373Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 03/17/2026 Severity Medium CVE-2025-13067Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 03/11/2026 Severity High CVE-2025-63018WordPress Bard theme <= 2.229 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product B Bard Published 01/22/2026 Severity Medium CVE-2025-5092Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 11/20/2025 Severity Medium CVE-2025-6251Royal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 11/19/2025 Severity Medium CVE-2025-24766WordPress News Magazine X <= 1.2.35 - Local File Inclusion Vulnerability Exploitation status Not known exploited Fix Affected product N News Magazine X Published 08/14/2025 Severity High CVE-2025-5338Royal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 06/26/2025 Severity Medium CVE-2025-3813Royal Elementor Addons and Templates <= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 05/31/2025 Severity Medium CVE-2025-39361WordPress Royal Elementor Addons plugin <= 1.7.1017 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product R Royal Elementor Addons Published 05/07/2025 Severity Medium CVE-2024-12120Royal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 05/07/2025 Severity Medium CVE-2025-1456Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated DOM-Based (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 04/12/2025 Severity Medium CVE-2025-1455Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 04/12/2025 Severity Medium CVE-2025-1441Royal Elementor Addons and Templates <= 1.7.1007 - Cross-Site Request Forgery to Reflected Cross-Site Scripting Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 02/19/2025 Severity Medium CVE-2025-0393Royal Elementor Addons and Templates <= 1.7.1006 - Cross-Site Request Forgery to Reflected Cross-Site Scripting Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 01/14/2025 Severity Medium CVE-2024-37490WordPress Bard theme <= 2.210 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product B Bard Published 01/02/2025 Severity Medium CVE-2024-37478WordPress Ashe theme <= 2.233 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product A Ashe Published 01/02/2025 Severity Medium CVE-2024-10798Royal Elementor Addons and Templates <= 1.7.1003 - Authenticated (Contributor+) Post Disclosure Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 11/28/2024 Severity Medium CVE-2024-10532Bard Extra <= 1.2.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import Exploitation status Not known exploited Fix Affected product B Bard Extra Published 11/21/2024 Severity Medium CVE-2024-9777Ashe <= 2.243 - Reflected Cross-Site Scripting via add_query_arg Parameter Exploitation status Not known exploited Fix Affected product A Ashe Published 11/19/2024 Severity Medium CVE-2024-9830Bard <= 2.216 - Reflected Cross-Site Scripting via add_query_arg Parameter Exploitation status Not known exploited Fix Affected product B Bard Published 11/19/2024 Severity Medium CVE-2024-9682Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 11/13/2024 Severity Medium CVE-2024-9668Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 11/13/2024 Severity Medium CVE-2024-9059Royal Elementor Addons and Template <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 11/13/2024 Severity Medium CVE-2024-7417Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Subscriber+) Private Post Disclosure Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 10/17/2024 Severity Medium CVE-2022-4974Freemius SDK <= 2.4.2 - Missing Authorization Checks Exploitation status Not known exploited Fix Affected product Y YASR – Yet Another Star Rating Plugin for WordPress Published 10/16/2024 Severity Medium CVE-2024-8482Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 10/08/2024 Severity Medium CVE-2024-5818Royal Elementor Addons and Templates <= 1.3.980 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider Widget Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 07/24/2024 Severity Medium CVE-2024-4488Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 06/07/2024 Severity Medium CVE-2024-4489Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploads Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 06/07/2024 Severity Medium CVE-2024-4087Royal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting via Back to Top Widget Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 06/01/2024 Severity Medium CVE-2024-4342Royal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 06/01/2024 Severity Medium CVE-2024-3887Royal Elementor Addons and Templates <= 1.3.974 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Builder Widget Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 05/16/2024 Severity Medium CVE-2024-1567Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 05/02/2024 Severity High CVE-2024-3675Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flip Carousel, Flip Box, Post Grid, and Taxonomy List Widget Attributes Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 05/02/2024 Severity Medium CVE-2024-3889Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Accordion Title Tags Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 04/23/2024 Severity Medium CVE-2024-2798Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 04/23/2024 Severity Medium CVE-2024-2799Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 04/23/2024 Severity Medium CVE-2024-1500Royal Elementor Addons and Templates <= 1.3.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Logo Widget Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 03/07/2024 Severity Medium CVE-2024-0516Royal Elementor Addons and Templates <= 1.3.87 - Missing Authorization via wpr_update_form_action_meta Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 02/20/2024 Severity Medium CVE-2024-0512Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_wishlist Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 02/20/2024 Severity Medium CVE-2024-0514Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_compare Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 02/20/2024 Severity Medium CVE-2024-0515Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_compare Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 02/20/2024 Severity Medium CVE-2024-0513Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_wishlist Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 02/20/2024 Severity Medium CVE-2024-0442Royal Elementor Addons and Templates <= 1.3.87 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 02/20/2024 Severity Medium CVE-2024-0511Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via wpr_update_form_action_meta Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 02/08/2024 Severity Medium CVE-2024-0835Royal Elementor Kit <= 1.0.116 - Missing Authorization to Arbitrary Transient Update Exploitation status Not known exploited Fix Affected product R Royal Elementor Kit Published 02/05/2024 Severity Medium CVE-2023-3709Royal Elementor Addons <=1.3.70 - Unauthenticated MailChimp API Key Disclosure Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 07/18/2023 Severity Medium CVE-2022-4707Royal Elementor Addons <= 1.3.59 - Cross-Site Request Forgery to Menu Template creation Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 01/10/2023 Severity Medium CVE-2022-4701Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Activation Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 01/10/2023 Severity Medium CVE-2022-4703Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Import Deletion Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 01/10/2023 Severity Medium CVE-2022-4705Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Activation Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 01/10/2023 Severity Medium CVE-2022-4704Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Import Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 01/10/2023 Severity Medium CVE-2022-4710Royal Elementor Addons <= 1.3.59 - Reflected Cross-Site Scripting Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 01/10/2023 Severity Medium CVE-2022-4708Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Conditions Modification Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 01/10/2023 Severity Medium CVE-2022-4711Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Menu Settings Update Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 01/10/2023 Severity Medium CVE-2022-4702Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Deactivation Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 01/10/2023 Severity Medium CVE-2022-4700Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Theme Activation Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 01/10/2023 Severity Medium CVE-2022-4709Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Kit Import Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 01/10/2023 Severity Medium 
