Vendor
WP Royal
93 known vulnerabilities.
Products
93 results · Feed
-
Medium 4.3
Royal Elementor Kit <= 1.0.116 - Missing Authorization to Arbitrary Transient Update
The Royal Elementor Kit theme for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the dismissed_handler function in all versions up to, and including, 1.0.116. This makes it possible for authenticated at…
-
Medium 5.3
Royal Elementor Addons <=1.3.70 - Unauthenticated MailChimp API Key Disclosure
The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 1.3.70 due to the plugin adding the API key to the source code of any page running the MailChimp block. This makes it possibl…
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Cross-Site Request Forgery to Menu Template creation
The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This is due to missing nonce validation in the 'wpr_create_mega_menu_template' AJAX function. This allows unauthenticated att…
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Activation
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level…
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Import Deletion
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level per…
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Activation
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level perm…
-
Medium 5.4
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Import
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level perm…
-
Medium 6.1
Royal Elementor Addons <= 1.3.59 - Reflected Cross-Site Scripting
The Royal Elementor Addons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.59, due to due to insufficient input sanitization and output escaping of the 'wpr_ajax_search_link_target' parameter in the '…
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Conditions Modification
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level …
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Menu Settings Update
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level p…
-
Medium 5.4
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Deactivation
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level p…
-
Medium 5.4
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Theme Activation
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level p…
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Kit Import
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level p…