Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Royal Addons for Elementor – Addons and Templates Kit for Elementor Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 83 vulnerability records associated with Royal Addons for Elementor – Addons and Templates Kit for Elementor, published between 2022 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

83Total records
1Critical
8High
74Medium
0Low
0Informational
83Patched records
0Currently marked unpatched
2022-03-04First disclosure
2026-06-26Latest disclosure
82 of 83CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
202255 records
20231616 records
20243232 records
20251313 records
20261717 records

Severity Breakdown

SeverityRecordsShare
Critical11.2%
High89.6%
Medium7489.2%

Vulnerability-Type Breakdown

Cross-Site Scripting

39 records47%

First: 2023. Latest: 2026.

Missing Authorization

13 records15.7%

First: 2022. Latest: 2026.

CSRF

12 records14.5%

First: 2022. Latest: 2025.

Privilege Escalation

8 records9.6%

First: 2023. Latest: 2023.

Other

4 records4.8%

First: 2024. Latest: 2026.

Information Disclosure

3 records3.6%

First: 2023. Latest: 2026.

Arbitrary File Upload

3 records3.6%

First: 2023. Latest: 2026.

Path Traversal

1 record1.2%

First: 2026. Latest: 2026.

Patch Status

Patched
83
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 1.7.1063
  • 1.7.1060
  • 1.7.1059
  • 1.7.1053
  • 1.7.1058
  • 1.7.1041
  • 1.7.1050
  • 1.7.1057
  • 1.7.1037
  • 1.7.1032
  • 1.7.1029
  • 1.7.1021
  • 1.7.1018
  • 1.3.979
  • 1.7.1013
  • 1.7.1007
  • 1.7.1008
  • 1.7.1
  • 1.7.1004
  • 1.7.1002
  • 1.3.981
  • 1.3.987
  • 1.3.985
  • 1.3.977
  • 1.3.976
  • 1.3.975
  • 1.3.972
  • 1.3.95
  • 1.3.92
  • 1.3.88
  • 1.3.81
  • 1.3.79
  • 1.3.76
  • 1.3.71
  • 1.3.60
  • 1.3.56
  • 1.3.33

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-1.7.1062Royal Elementor Addons <= 1.7.1062 - Unauthenticated Information ExposureJune 26, 20261.7.1063Medium
1.7.1058-1.7.1059Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File SourceJune 18, 20261.7.1060Medium
*-1.7.1058Royal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' ParameterMay 13, 20261.7.1059Medium
[*, 1.7.1053)Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Authenticated (Contributor+) Stored Cross-Site ScriptingMay 7, 20261.7.1053Medium
[*, 1.7.1053)Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Missing AuthorizationMay 7, 20261.7.1053Medium
*-1.7.1056Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' ParameterMay 4, 20261.7.1057Medium
*-1.7.1056Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_metaMay 4, 20261.7.1057High
*-1.7.1056Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta ModificationMay 1, 20261.7.1057Medium
*-1.7.1057Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL ParameterMay 1, 20261.7.1058High
*-1.7.1056Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption FieldApril 23, 20261.7.1057Medium
*-1.7.1056Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed WidgetApril 16, 20261.7.1057Medium
[*, 1.7.1041)Royal Elementor Addons < 1.7.1041 - Unauthenticated Stored Cross-Site ScriptingApril 16, 20261.7.1041High
*-1.7.1049Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta BypassApril 3, 20261.7.1050Medium
*-1.7.1056Royal Elementor Addons <= 1.7.1056 - Missing AuthorizationMarch 31, 20261.7.1057Medium
*-1.7.1049Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents ExposureMarch 16, 20261.7.1050Medium
*-1.7.1049Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload BypassMarch 10, 20261.7.1050High
*-1.7.1052Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1052 - Missing AuthorizationFebruary 26, 20261.7.1053Medium
*-1.7.1036Royal Elementor Addons and Templates <= 1.7.1036 - Missing Authorization to Unauthenticated Media File UploadNovember 24, 20251.7.1037Medium
*-1.7.1031Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript LibraryNovember 19, 20251.7.1032Medium
*-1.7.1036Royal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site ScriptingNovember 18, 20251.7.1037Medium
*-1.7.1028Royal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple WidgetsJune 25, 20251.7.1029Medium
*-1.7.1020Royal Elementor Addons and Templates <= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site ScriptingMay 30, 20251.7.1021Medium
*-1.7.1017Royal Elementor Addons <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site ScriptingMay 7, 20251.7.1018Medium
*-1.7.1017Royal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site ScriptingMay 6, 20251.7.1018Medium
*-1.3.977Royal Elementor Addons <= 1.3.977 - Authenticated (Contributor+) Stored Cross-Site ScriptingApril 16, 20251.3.979Medium

Selected source records

Latest Records

MediumCVE-2026-13402

Royal Elementor Addons <= 1.7.1062 - Unauthenticated Information Exposure

Published: June 26, 2026

Affected versions
*-1.7.1062
Patched versions
1.7.1063
Original Wordfence record
MediumCVE-2026-8118

Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source

Published: June 18, 2026

Affected versions
1.7.1058-1.7.1059
Patched versions
1.7.1060
Original Wordfence record
MediumCVE-2026-6504

Royal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter

Published: May 13, 2026

Affected versions
*-1.7.1058
Patched versions
1.7.1059
Original Wordfence record
MediumCVE-2026-25436

Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Missing Authorization

Published: May 7, 2026

Affected versions
[*, 1.7.1053)
Patched versions
1.7.1053
Original Wordfence record
MediumCVE-2026-27421

Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: May 7, 2026

Affected versions
[*, 1.7.1053)
Patched versions
1.7.1053
Original Wordfence record
MediumCVE-2026-5159

Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter

Published: May 4, 2026

Affected versions
*-1.7.1056
Patched versions
1.7.1057
Original Wordfence record
HighCVE-2026-4803

Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta

Published: May 4, 2026

Affected versions
*-1.7.1056
Patched versions
1.7.1057
Original Wordfence record
MediumCVE-2026-4024

Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification

Published: May 1, 2026

Affected versions
*-1.7.1056
Patched versions
1.7.1057
Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-5360

Royal Elementor Addons and Templates <= 1.3.78 - Unauthenticated Arbitrary File Upload

Published: October 9, 2023

Affected versions
*-1.3.78
Patched versions
1.3.79
Original Wordfence record
HighCVE-2025-13067

Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass

Published: March 10, 2026

Affected versions
*-1.7.1049
Patched versions
1.7.1050
Original Wordfence record
High

Royal Elementor Addons <= 1.3.55 - Cross-Site Request Forgery

Published: December 6, 2022

Affected versions
*-1.3.55
Patched versions
1.3.56
Original Wordfence record
HighCVE-2024-1567

Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload

Published: April 19, 2024

Affected versions
*-1.3.94
Patched versions
1.3.95
Original Wordfence record
HighCVE-2022-4102

Royal Elementor Addons <= 1.3.55 - Cross-Site Request Forgery

Published: December 15, 2022

Affected versions
*-1.3.55
Patched versions
1.3.56
Original Wordfence record
HighCVE-2022-4102

Royal Elementor Addons <=1.3.55 - Authenticated (Subscriber+) Arbitrary Post Deletion

Published: December 15, 2022

Affected versions
*-1.3.55
Patched versions
1.3.56
Original Wordfence record
HighCVE-2026-40720

Royal Elementor Addons < 1.7.1041 - Unauthenticated Stored Cross-Site Scripting

Published: April 16, 2026

Affected versions
[*, 1.6.01)
Patched versions
1.6.01
Affected versions
[*, 1.7.1041)
Patched versions
1.7.1041
Original Wordfence record
HighCVE-2026-6229

Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter

Published: May 1, 2026

Affected versions
*-1.7.1057
Patched versions
1.7.1058
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory