Royal Addons For Elementor
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:royal_addons_for_elementor:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Royal Addons For Elementor (91367b59-3e94-5eca-950f-5ab69957ba8d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-106647 |
vulnerable | 2026-11-03 10:16:13.665909 |
Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page source, allowing users with the Author role or above to overwrite another user's form configuration and have that form's submissions delivered to an attacker-controlled address.
Published: 2026-10-28T06:00:21.875Z
Updated: 2026-10-28T17:58:08.236Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-107097 |
vulnerable | 2026-11-03 10:15:59.402529 |
Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.
Published: 2026-10-28T06:00:22.291Z
Updated: 2026-10-28T17:58:08.091Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-107100 |
vulnerable | 2026-11-03 10:15:59.170648 |
Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to disclose the content of posts stored in non-public post types, for example captured contact-form submissions containing names, email addresses and messages.
Published: 2026-10-28T06:00:22.651Z
Updated: 2026-10-28T17:58:07.790Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-107098 |
vulnerable | 2026-11-03 10:15:58.988094 |
Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views the page, including an administrator reviewing a pending submission.
Published: 2026-10-28T06:00:22.478Z
Updated: 2026-10-28T17:58:07.940Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13407 |
vulnerable | 2026-10-13 12:28:38.982557 |
Royal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails
MEDIUM (6.1)
The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the site administrator on form submission.
Published: 2026-09-16T06:29:58.359Z
Updated: 2026-09-16T17:40:13.883Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-19217 |
vulnerable | 2026-09-16 04:34:15.357490 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13402 |
vulnerable | 2026-07-29 00:23:33.021322 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11363 |
vulnerable | 2026-06-08 07:02:28.659217 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.