Royal Elementor Addons
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:royal_elementor_addons:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Royal Elementor Addons (c5ad136d-67f0-51e5-90da-29e65e444777) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-106648 |
vulnerable | 2026-11-03 10:16:14.140946 |
Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes
MEDIUM (5.3)
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from the site's own domain when a recipient field is configured to echo a submitted value.
Published: 2026-10-28T10:45:12.999Z
Updated: 2026-10-28T17:47:59.741Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.