← All plugins

Plugin vulnerabilities

Is Royal Elementor Addons safe? Known vulnerabilities and the version to run.

Royal Elementor Addons: adds widgets, templates and a theme builder to Elementor.

Updated from Wordfence Intelligence

The short answer

Run Royal Elementor Addons 1.7.1070 or later. That version has a fix for every known vulnerability that's been patched.

Known vulnerabilities
101
In the last 12 months
38
Rated high or critical
13
No fix yet
0

Every known Royal Elementor Addons vulnerability

Newest first. The most recent was disclosed on 6 November 2026. Each one links to its full record on Wordfence.

VulnerabilitySeverityAffected versionsFixed in
Missing AuthorizationCVE-2026-119519 · 6 November 2026Medium 4.31.7.1068 and earlier1.7.1069
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1037 - 1.7.1069 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2026-107098 · 28 October 2026Medium 6.41.7.1037 to 1.7.10691.7.1070
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.3.71 - 1.7.1069 - Missing AuthorizationCVE-2026-107097 · 28 October 2026Medium 5.31.3.71 to 1.7.10691.7.1070
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.3.81 - 1.7.1069 - Unauthenticated Information ExposureCVE-2026-107100 · 28 October 2026Medium 5.31.3.81 to 1.7.10691.7.1070
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.3.68 - 1.7.1069 - Missing AuthorizationCVE-2026-106647 · 28 October 2026Medium 4.31.3.68 to 1.7.10691.7.1070
Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2026-112865 · 26 October 2026Medium 6.41.7.1069 and earlier1.7.1070
Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2026-97254 · 26 October 2026Medium 6.41.7.1069 and earlier1.7.1070
Unauthenticated Insecure Direct Object ReferenceCVE-2026-97255 · 26 October 2026Medium 5.31.7.1069 and earlier1.7.1070
Unauthenticated Unauthorized Email RelayCVE-2026-106648 · 26 October 2026Medium 5.3before 1.7.10701.7.1070
Authenticated (Contributor+) Remote Code ExecutionCVE-2026-111851 · 20 October 2026High 8.81.7.1068 and earlier1.7.1069
Unauthenticated Arbitrary HTML Injection in Notification EmailsCVE-2026-13407 · 14 September 2026High 7.21.7.1066 and earlier1.7.1067
Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' ParameterCVE-2026-17585 · 11 September 2026Medium 5.31.7.1066 and earlier1.7.1067
Missing AuthorizationCVE-2026-13406 · 26 August 2026Medium 5.3before 1.7.10661.7.1066
Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2026-19226 · 26 August 2026Medium 6.4before 1.7.10661.7.1066
Unauthenticated Like Count ManipulationCVE-2026-13404 · 24 August 2026Medium 5.3before 1.7.10661.7.1066
Authenticated (Administrator+) Remote Code ExecutionCVE-2026-13405 · 21 August 2026High 7.2before 1.7.10661.7.1066
Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' SettingCVE-2026-17123 · 15 August 2026High 8.81.7.1064 and earlier1.7.1065
Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2026-19217 · 10 August 2026Medium 6.41.7.1064 and earlier1.7.1065
Unauthenticated Information ExposureCVE-2026-13402 · 26 June 2026Medium 5.31.7.1062 and earlier1.7.1063
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File SourceCVE-2026-8118 · 18 June 2026Medium 6.51.7.1058 to 1.7.10591.7.1060
Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' ParameterCVE-2026-6504 · 13 May 2026Medium 6.41.7.1058 and earlier1.7.1059
Missing AuthorizationCVE-2026-25436 · 7 May 2026Medium 5.3before 1.7.10531.7.1053
Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2026-27421 · 7 May 2026Medium 6.4before 1.7.10531.7.1053
Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_metaCVE-2026-4803 · 4 May 2026High 7.21.7.1056 and earlier1.7.1057
Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' ParameterCVE-2026-5159 · 4 May 2026Medium 6.41.7.1056 and earlier1.7.1057

If you run Royal Elementor Addons

What to do now

  1. Check your version. In WordPress, go to Plugins and look under Royal Elementor Addons. Compare it with the affected versions above.
  2. Update to 1.7.1070 or later. Take a backup first, then update. If the update breaks something, you can restore the backup while you work out why.
  3. Check the rest of your site. One outdated plugin is rarely the only one. Our free security check looks at your WordPress version, and the plugins and theme it can see from the outside, for known flaws and emails you a report.

Pressfort keeps your plugins up to date for you, testing each update on a copy of your site first, and its virtual patching blocks attacks on newly disclosed flaws, often before a fix is out. If your site does get hacked, two clean-ups a year are included, with a developer stepping in when needed. See how it works.

Page builders and add-ons

Elementor Pro

The paid version of Elementor, adding theme building, forms, popups and WooCommerce widgets.

17 known1 in the last year

Elementor

A drag-and-drop page builder, and one of the most widely used plugins on WordPress.

61 known18 in the last year

Starter Templates

Imports ready-made site designs for the Astra theme and popular page builders.

12 known4 in the last year

ElementsKit

Adds extra widgets, a mega menu and header and footer builders to Elementor.

31 known10 in the last year

Essential Addons

A collection of extra widgets and extensions for the Elementor page builder.

76 known24 in the last year

Spectra

Adds extra blocks and layout tools to the WordPress block editor.

33 known9 in the last year

Data sources and licences

Vulnerability data comes from Wordfence Intelligence and is refreshed daily. Severity is the CVSS score given in each record. Pressfort is not affiliated with Wordfence or Defiant Inc.

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

https://www.cve.org/Legal/TermsOfUse

Not sure yet?

Find out how exposed your site is.

Send us your site address and get a free, plain-English report of what we find. We check from the outside, so there are no logins to hand over and nothing to install.

Get a free security check Or protect it now
Security check
yourbusiness.com
Example
1 urgent2 to fix
  • Known vulnerability in 1 pluginGallery plugin, file upload flawUrgent
  • WordPress is out of dateRunning 6.7.1, latest is 6.8.3To fix
  • 6 plugins and 1 theme out of dateOldest is 14 months behindTo fix