Unknown Royal Addons For Elementor vulnerabilities

8 CVEs affecting Unknown Royal Addons For Elementor, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-13407, published 2026-09-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-13405, published 2026-08-20. Medium severity, CVSS 6.6. EPSS: 0.4% chance of exploitation in the next 30 days. The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the…
CVE-2026-13402, published 2026-07-17. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated…
CVE-2025-11363, published 2025-12-15. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Royal Addons for Elementor WordPress plugin before 1.7.1037 does not have proper authorisation, allowing unauthenticated users to upload media files via the wpr_addons_upload_file action.
CVE-2026-13406, published 2026-08-26. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy,…
CVE-2026-19226, published 2026-08-26. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor…
CVE-2026-19217, published 2026-08-12. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role…
CVE-2026-13404, published 2026-08-26. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and…
CVE-2026-13407, published 2026-09-16. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator…