Plugin security history

Royal Addons for Elementor – Addons and Templates Kit for Elementor Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 83 vulnerability records associated with Royal Addons for Elementor – Addons and Templates Kit for Elementor, published between 2022 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

83Total records

1Critical

8High

74Medium

0Low

0Informational

83Patched records

0Currently marked unpatched

2022-03-04First disclosure

2026-06-26Latest disclosure

82 of 83CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2022	5	5 records
2023	16	16 records
2024	32	32 records
2025	13	13 records
2026	17	17 records

Severity Breakdown

Severity	Records	Share
Critical	1	1.2%
High	8	9.6%
Medium	74	89.2%

Vulnerability-Type Breakdown

Cross-Site Scripting

39 records47%

First: 2023. Latest: 2026.

Missing Authorization

13 records15.7%

First: 2022. Latest: 2026.

CSRF

12 records14.5%

First: 2022. Latest: 2025.

Privilege Escalation

8 records9.6%

First: 2023. Latest: 2023.

Other

4 records4.8%

First: 2024. Latest: 2026.

Information Disclosure

3 records3.6%

First: 2023. Latest: 2026.

Arbitrary File Upload

3 records3.6%

First: 2023. Latest: 2026.

Path Traversal

1 record1.2%

First: 2026. Latest: 2026.

Patch Status

Patched: 83
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.7.1063
1.7.1060
1.7.1059
1.7.1053
1.7.1058
1.7.1041
1.7.1050
1.7.1057
1.7.1037
1.7.1032
1.7.1029
1.7.1021
1.7.1018
1.3.979
1.7.1013
1.7.1007
1.7.1008
1.7.1
1.7.1004
1.7.1002
1.3.981
1.3.987
1.3.985
1.3.977
1.3.976
1.3.975
1.3.972
1.3.95
1.3.92
1.3.88
1.3.81
1.3.79
1.3.76
1.3.71
1.3.60
1.3.56
1.3.33

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-1.7.1012`	Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated DOM-Based (Contributor+) Stored Cross-Site Scripting	April 11, 2025	1.7.1013	Medium
`*-1.7.1012`	Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated (Contributor+) Stored Cross-Site Scripting	April 11, 2025	1.7.1013	Medium
`*-1.7.1006`	Royal Elementor Addons <= 1.7.1006 - Authenticated (Admin+) Server Side Request Forgery	April 11, 2025	1.7.1007	Medium
`*-1.7.1007`	Royal Elementor Addons and Templates <= 1.7.1007 - Cross-Site Request Forgery to Reflected Cross-Site Scripting	February 18, 2025	1.7.1008	Medium
`*-1.7.1006`	Royal Elementor Addons and Templates <= 1.7.1006 - Cross-Site Request Forgery to Reflected Cross-Site Scripting	January 13, 2025	1.7.1007	Medium
`*-1.7.1001`	Royal Elementor Addons <= 1.7.1001 - Missing Authorization	December 19, 2024	1.7.1002	Medium
`*-1.7.1001`	Royal Elementor Addons <= 1.7.1001 - Reflected Cross-Site Scripting	December 19, 2024	1.7.1002	Medium
`*-1.3.987`	Royal Elementor Addons <= 1.3.987 - Authenticated (Contributor+) Stored Cross-Site Scripting	December 18, 2024	1.7.1	Medium
`*-1.7.1003`	Royal Elementor Addons and Templates <= 1.7.1003 - Authenticated (Contributor+) Post Disclosure	November 27, 2024	1.7.1004	Medium
`*-1.7.1001`	Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget	November 12, 2024	1.7.1002	Medium
`*-1.7.1001`	Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	November 12, 2024	1.7.1002	Medium
`*-1.7.1001`	Royal Elementor Addons and Template <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget	November 12, 2024	1.7.1002	Medium
`*-1.3.980`	Royal Elementor Addons <= 1.3.980 - Authenticated (Author+) External Entity Injection	October 24, 2024	1.3.981	Medium
`*-1.3.986`	Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Subscriber+) Private Post Disclosure	October 16, 2024	1.3.987	Medium
`*-1.3.986`	Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget	October 7, 2024	1.3.987	Medium
`*-1.3.982`	Royal Elementor Addons <= 1.3.982 - Authenticated (Contributor+) Stored Cross-Site Scripting	August 29, 2024	1.3.985	Medium
`*-1.3.980`	Royal Elementor Addons and Templates <= 1.3.980 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider Widget	July 23, 2024	1.3.981	Medium
`*-1.3.976`	Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scripting	June 6, 2024	1.3.977	Medium
`*-1.3.976`	Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploads	June 6, 2024	1.3.977	Medium
`*-1.3.975`	Royal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting via Back to Top Widget	May 31, 2024	1.3.976	Medium
`*-1.3.975`	Royal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 31, 2024	1.3.976	Medium
`*-1.3.974`	Royal Elementor Addons and Templates <= 1.3.974 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Builder Widget	May 15, 2024	1.3.975	Medium
`*-1.3.971`	Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Accordion Title Tags	April 22, 2024	1.3.972	Medium
`*-1.3.971`	Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	April 22, 2024	1.3.972	Medium
`*-1.3.971`	Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags	April 22, 2024	1.3.972	Medium

Selected source records

Latest Records

MediumCVE-2026-13402

Royal Elementor Addons <= 1.7.1062 - Unauthenticated Information Exposure

Published: June 26, 2026

Affected versions: *-1.7.1062
Patched versions: 1.7.1063

Original Wordfence record

MediumCVE-2026-8118

Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source

Published: June 18, 2026

Affected versions: 1.7.1058-1.7.1059
Patched versions: 1.7.1060

Original Wordfence record

MediumCVE-2026-6504

Royal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter

Published: May 13, 2026

Affected versions: *-1.7.1058
Patched versions: 1.7.1059

Original Wordfence record

MediumCVE-2026-25436

Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Missing Authorization

Published: May 7, 2026

Affected versions: [*, 1.7.1053)
Patched versions: 1.7.1053

Original Wordfence record

MediumCVE-2026-27421

Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: May 7, 2026

Affected versions: [*, 1.7.1053)
Patched versions: 1.7.1053

Original Wordfence record

MediumCVE-2026-5159

Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter

Published: May 4, 2026

Affected versions: *-1.7.1056
Patched versions: 1.7.1057

Original Wordfence record

HighCVE-2026-4803

Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta

Published: May 4, 2026

Affected versions: *-1.7.1056
Patched versions: 1.7.1057

Original Wordfence record

MediumCVE-2026-4024

Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification

Published: May 1, 2026

Affected versions: *-1.7.1056
Patched versions: 1.7.1057

Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-5360

Royal Elementor Addons and Templates <= 1.3.78 - Unauthenticated Arbitrary File Upload

Published: October 9, 2023

Affected versions: *-1.3.78
Patched versions: 1.3.79

Original Wordfence record

HighCVE-2025-13067

Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass

Published: March 10, 2026

Affected versions: *-1.7.1049
Patched versions: 1.7.1050

Original Wordfence record

High

Royal Elementor Addons <= 1.3.55 - Cross-Site Request Forgery

Published: December 6, 2022

Affected versions: *-1.3.55
Patched versions: 1.3.56

Original Wordfence record

HighCVE-2024-1567

Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload

Published: April 19, 2024

Affected versions: *-1.3.94
Patched versions: 1.3.95

Original Wordfence record

HighCVE-2022-4102

Royal Elementor Addons <= 1.3.55 - Cross-Site Request Forgery

Published: December 15, 2022

Affected versions: *-1.3.55
Patched versions: 1.3.56

Original Wordfence record

HighCVE-2022-4102

Royal Elementor Addons <=1.3.55 - Authenticated (Subscriber+) Arbitrary Post Deletion

Published: December 15, 2022

Affected versions: *-1.3.55
Patched versions: 1.3.56

Original Wordfence record

HighCVE-2026-40720

Royal Elementor Addons < 1.7.1041 - Unauthenticated Stored Cross-Site Scripting

Published: April 16, 2026

Affected versions: [*, 1.6.01)
Patched versions: 1.6.01

Affected versions: [*, 1.7.1041)
Patched versions: 1.7.1041

Original Wordfence record

HighCVE-2026-6229

Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter

Published: May 1, 2026

Affected versions: *-1.7.1057
Patched versions: 1.7.1058

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory