Skip to content
OpenAdvisories
High WID-SEC-2026-2859 2 CVEs

WP Royal Royal Elementor Addons: Mehrere Schwachstellen

Published Aug 16, 2026 · Updated Aug 16, 2026 · de-DE

Vendor: WP Royal Product: Royal Elementor Addons Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in WP Royal Royal Elementor Addons ausnutzen, um serverseitige Request-Forgery- und Cross-Site-Scripting-Angriffe durchzuführen.

Product

Royal Elementor Addons ist eine vielseitige und intuitive Page Builder-Erweiterung für das WordPress Content Management System.

Vulnerabilities 2

  • High 8.8
    CVE-2026-17123

    Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting

    The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhook_url' setting. The widget's render() method persists the attacker-controlled URL into…

    WP Royal Royal Addons for Elementor – Addons and Templates Kit for Elementor Web / CMS
  • Medium 5.4
    CVE-2026-19217

    Royal Elementor Addons < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget

    The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

    Web / CMS

Revision history

  1. #1

    Initiale Fassung

References

  • Wordfence CVE-2026-19217 vom 2026-08-16
    https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/royal-elementor-addons/royal-elementor-addons-171064-authenticated-contributor-stored-cross-site-scripting
  • Wordfence CVE-2026-17123 vom 2026-08-16
    https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/royal-elementor-addons/royal-addons-for-elementor-171064-authenticated-contributor-server-side-request-forgery-via-form-builder-widget-webhook-url-setting