Plugin security history

Royal Addons for Elementor – Addons and Templates Kit for Elementor Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 83 vulnerability records associated with Royal Addons for Elementor – Addons and Templates Kit for Elementor, published between 2022 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

83Total records

1Critical

8High

74Medium

0Low

0Informational

83Patched records

0Currently marked unpatched

2022-03-04First disclosure

2026-06-26Latest disclosure

82 of 83CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2022	5	5 records
2023	16	16 records
2024	32	32 records
2025	13	13 records
2026	17	17 records

Severity Breakdown

Severity	Records	Share
Critical	1	1.2%
High	8	9.6%
Medium	74	89.2%

Vulnerability-Type Breakdown

Cross-Site Scripting

39 records47%

First: 2023. Latest: 2026.

Missing Authorization

13 records15.7%

First: 2022. Latest: 2026.

CSRF

12 records14.5%

First: 2022. Latest: 2025.

Privilege Escalation

8 records9.6%

First: 2023. Latest: 2023.

Other

4 records4.8%

First: 2024. Latest: 2026.

Information Disclosure

3 records3.6%

First: 2023. Latest: 2026.

Arbitrary File Upload

3 records3.6%

First: 2023. Latest: 2026.

Path Traversal

1 record1.2%

First: 2026. Latest: 2026.

Patch Status

Patched: 83
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.7.1063
1.7.1060
1.7.1059
1.7.1053
1.7.1058
1.7.1041
1.7.1050
1.7.1057
1.7.1037
1.7.1032
1.7.1029
1.7.1021
1.7.1018
1.3.979
1.7.1013
1.7.1007
1.7.1008
1.7.1
1.7.1004
1.7.1002
1.3.981
1.3.987
1.3.985
1.3.977
1.3.976
1.3.975
1.3.972
1.3.95
1.3.92
1.3.88
1.3.81
1.3.79
1.3.76
1.3.71
1.3.60
1.3.56
1.3.33

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-1.3.971`	Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flip Carousel, Flip Box, Post Grid, and Taxonomy List Widget Attributes	April 22, 2024	1.3.972	Medium
`*-1.3.93`	Royal Elementor Addons <= 1.3.93 - Unauthenticated IP Spoofing	April 22, 2024	1.3.95	Medium
`*-1.3.94`	Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload	April 19, 2024	1.3.95	High
`*-1.3.93`	Royal Elementor Addons <= 1.3.93 - Authenticated (Contributor+) Stored Cross-Site Scriting	April 5, 2024	1.3.95	Medium
`*-1.3.91`	Royal Elementor Addons and Templates <= 1.3.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Logo Widget	March 6, 2024	1.3.92	Medium
`*-1.3.87`	Royal Elementor Addons and Templates <= 1.3.87 - Authenticated (Contributor+) Stored Cross-Site Scripting	February 8, 2024	1.3.88	Medium
`*-1.3.87`	Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via wpr_update_form_action_meta	February 7, 2024	1.3.88	Medium
`*-1.3.87`	Royal Elementor Addons and Templates <= 1.3.87 - Missing Authorization via wpr_update_form_action_meta	February 7, 2024	1.3.88	Medium
`*-1.3.87`	Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_wishlist	February 7, 2024	1.3.88	Medium
`*-1.3.87`	Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_compare	February 7, 2024	1.3.88	Medium
`*-1.3.87`	Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_compare	February 7, 2024	1.3.88	Medium
`*-1.3.87`	Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_wishlist	February 7, 2024	1.3.88	Medium
`*-1.3.80`	Royal Elementor Addons and Templates <= 1.3.80 - Missing Authorization to Private/Password Protected Post Read	December 6, 2023	1.3.81	Medium
`*-1.3.78`	Royal Elementor Addons and Templates <= 1.3.78 - Unauthenticated Arbitrary File Upload	October 9, 2023	1.3.79	Critical
`*-1.3.75`	Royal Elementor Addons <= 1.3.75 - Cross-Site Request Forgery	August 22, 2023	1.3.76	Medium
`1.3-1.3.70`	Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get	July 18, 2023	1.3.71	Medium
`*-1.3.70`	Royal Elementor Addons <=1.3.70 - Unauthenticated MailChimp API Key Disclosure	July 17, 2023	1.3.71	Medium
`*-1.3.59`	Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Kit Import	January 10, 2023	1.3.60	Medium
`*-1.3.59`	Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Theme Activation	January 10, 2023	1.3.60	Medium
`*-1.3.59`	Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Deactivation	January 10, 2023	1.3.60	Medium
`*-1.3.59`	Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Menu Settings Update	January 10, 2023	1.3.60	Medium
`*-1.3.59`	Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Conditions Modification	January 10, 2023	1.3.60	Medium
`*-1.3.59`	Royal Elementor Addons <= 1.3.59 - Reflected Cross-Site Scripting	January 10, 2023	1.3.60	Medium
`*-1.3.59`	Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Import	January 10, 2023	1.3.60	Medium
`*-1.3.59`	Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Import Deletion	January 10, 2023	1.3.60	Medium

Selected source records

Latest Records

MediumCVE-2026-13402

Royal Elementor Addons <= 1.7.1062 - Unauthenticated Information Exposure

Published: June 26, 2026

Affected versions: *-1.7.1062
Patched versions: 1.7.1063

Original Wordfence record

MediumCVE-2026-8118

Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source

Published: June 18, 2026

Affected versions: 1.7.1058-1.7.1059
Patched versions: 1.7.1060

Original Wordfence record

MediumCVE-2026-6504

Royal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter

Published: May 13, 2026

Affected versions: *-1.7.1058
Patched versions: 1.7.1059

Original Wordfence record

MediumCVE-2026-25436

Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Missing Authorization

Published: May 7, 2026

Affected versions: [*, 1.7.1053)
Patched versions: 1.7.1053

Original Wordfence record

MediumCVE-2026-27421

Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: May 7, 2026

Affected versions: [*, 1.7.1053)
Patched versions: 1.7.1053

Original Wordfence record

MediumCVE-2026-5159

Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter

Published: May 4, 2026

Affected versions: *-1.7.1056
Patched versions: 1.7.1057

Original Wordfence record

HighCVE-2026-4803

Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta

Published: May 4, 2026

Affected versions: *-1.7.1056
Patched versions: 1.7.1057

Original Wordfence record

MediumCVE-2026-4024

Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification

Published: May 1, 2026

Affected versions: *-1.7.1056
Patched versions: 1.7.1057

Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-5360

Royal Elementor Addons and Templates <= 1.3.78 - Unauthenticated Arbitrary File Upload

Published: October 9, 2023

Affected versions: *-1.3.78
Patched versions: 1.3.79

Original Wordfence record

HighCVE-2025-13067

Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass

Published: March 10, 2026

Affected versions: *-1.7.1049
Patched versions: 1.7.1050

Original Wordfence record

High

Royal Elementor Addons <= 1.3.55 - Cross-Site Request Forgery

Published: December 6, 2022

Affected versions: *-1.3.55
Patched versions: 1.3.56

Original Wordfence record

HighCVE-2024-1567

Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload

Published: April 19, 2024

Affected versions: *-1.3.94
Patched versions: 1.3.95

Original Wordfence record

HighCVE-2022-4102

Royal Elementor Addons <= 1.3.55 - Cross-Site Request Forgery

Published: December 15, 2022

Affected versions: *-1.3.55
Patched versions: 1.3.56

Original Wordfence record

HighCVE-2022-4102

Royal Elementor Addons <=1.3.55 - Authenticated (Subscriber+) Arbitrary Post Deletion

Published: December 15, 2022

Affected versions: *-1.3.55
Patched versions: 1.3.56

Original Wordfence record

HighCVE-2026-40720

Royal Elementor Addons < 1.7.1041 - Unauthenticated Stored Cross-Site Scripting

Published: April 16, 2026

Affected versions: [*, 1.6.01)
Patched versions: 1.6.01

Affected versions: [*, 1.7.1041)
Patched versions: 1.7.1041

Original Wordfence record

HighCVE-2026-6229

Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter

Published: May 1, 2026

Affected versions: *-1.7.1057
Patched versions: 1.7.1058

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory