Summary
Ein Angreifer kann mehrere Schwachstellen in WP Royal Royal Elementor Addons ausnutzen, um Dateien zu manipulieren und Cross-Site-Scripting-Angriffe durchzuführen.
Product
Royal Elementor Addons ist eine vielseitige und intuitive Page Builder-Erweiterung für das WordPress Content Management System.
Vulnerabilities 2
-
Medium 6.8
Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
-
Medium 5.3
Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing u…
Revision history
-
#1
Initiale Fassung
References
-
WPScan Vulnerability Advisory CVE-2026-13404 vom 2026-08-26
https://wpscan.com/vulnerability/c4915a6c-8bf5-46aa-8134-ea490bd6137f/
-
WPScan Vulnerability Advisory CVE-2026-19226 vom 2026-08-26
https://wpscan.com/vulnerability/1454d76e-c90b-40b3-b0b8-fb9a25ffb183/