# cve.now: Wproyal

The newest entries naming Wproyal as an affected vendor (up to 200), of 78 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119519](https://cve.now/CVE-2026-119519.md): WordPress Royal Elementor Addons plugin \<= 1.7.1068 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-97255](https://cve.now/CVE-2026-97255.md): WordPress Royal Elementor Addons plugin \<= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
- [CVE-2026-97254](https://cve.now/CVE-2026-97254.md): WordPress Royal Elementor Addons plugin \<= 1.7.1069 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-112865](https://cve.now/CVE-2026-112865.md): WordPress Royal Elementor Addons plugin \<= 1.7.1069 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-111851](https://cve.now/CVE-2026-111851.md): WordPress Royal Elementor Addons plugin \<= 1.7.1068 - Arbitrary Code Execution vulnerability (CVSS 7.6)
- [CVE-2026-17585](https://cve.now/CVE-2026-17585.md): Royal Addons for Elementor \<= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta\_query LIKE Oracle in 'wpr\_keyword' Parameter (CVSS 5.3)
- [CVE-2026-17123](https://cve.now/CVE-2026-17123.md): Royal Addons for Elementor \<= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook\_url' Setting (CVSS 8.8)
- [CVE-2026-8118](https://cve.now/CVE-2026-8118.md): Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source (CVSS 6.5)
- [CVE-2026-6504](https://cve.now/CVE-2026-6504.md): Royal Addons for Elementor \<= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title\_tag' Parameter (CVSS 6.4)
- [CVE-2026-25436](https://cve.now/CVE-2026-25436.md): WordPress Royal Elementor Addons plugin \< 1.7.1053 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-27421](https://cve.now/CVE-2026-27421.md): WordPress Royal Elementor Addons plugin \< 1.7.1053 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-5159](https://cve.now/CVE-2026-5159.md): Royal Addons for Elementor \<= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter (CVSS 6.4)
- [CVE-2026-4803](https://cve.now/CVE-2026-4803.md): Royal Addons for Elementor \<= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr\_update\_form\_action\_meta (CVSS 7.2)
- [CVE-2026-4024](https://cve.now/CVE-2026-4024.md): Royal Addons for Elementor \<= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification (CVSS 5.3)
- [CVE-2026-6229](https://cve.now/CVE-2026-6229.md): Royal Addons for Elementor \<= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter (CVSS 7.2)
- [CVE-2026-5428](https://cve.now/CVE-2026-5428.md): Royal Addons for Elementor \<= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field (CVSS 6.4)
- [CVE-2026-5162](https://cve.now/CVE-2026-5162.md): Royal Addons for Elementor \<= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget (CVSS 6.4)
- [CVE-2026-4305](https://cve.now/CVE-2026-4305.md): Royal WordPress Backup & Restore Plugin \<= 1.0.16 - Reflected Cross-Site Scripting via 'wpr\_pending\_template' Parameter (CVSS 6.1)
- [CVE-2026-39627](https://cve.now/CVE-2026-39627.md): WordPress Ashe theme \<= 2.266 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-0664](https://cve.now/CVE-2026-0664.md): Royal Elementor Addons \<= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass (CVSS 6.4)
- [CVE-2026-24382](https://cve.now/CVE-2026-24382.md): WordPress News Magazine X theme \<= 1.2.50 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-2373](https://cve.now/CVE-2026-2373.md): Royal Addons for Elementor – Addons and Templates Kit for Elementor \<= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure (CVSS 5.3)
- [CVE-2025-13067](https://cve.now/CVE-2025-13067.md): Royal Addons for Elementor \<= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass (CVSS 8.8)
- [CVE-2025-63018](https://cve.now/CVE-2025-63018.md): WordPress Bard theme \<= 2.229 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-5092](https://cve.now/CVE-2025-5092.md): Multiple Plugins and Themes \<= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library (CVSS 6.4)
- [CVE-2025-6251](https://cve.now/CVE-2025-6251.md): Royal Elementor Addons and Templates \<= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-24766](https://cve.now/CVE-2025-24766.md): WordPress News Magazine X \<= 1.2.35 - Local File Inclusion Vulnerability (CVSS 7.5)
- [CVE-2025-5338](https://cve.now/CVE-2025-5338.md): Royal Elementor Addons \<= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets (CVSS 6.4)
- [CVE-2025-3813](https://cve.now/CVE-2025-3813.md): Royal Elementor Addons and Templates \<= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-12120](https://cve.now/CVE-2024-12120.md): Royal Elementor Addons and Templates \<= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
- [CVE-2025-1456](https://cve.now/CVE-2025-1456.md): Royal Elementor Addons and Templates \<= 1.7.1012 - Authenticated DOM-Based (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-1455](https://cve.now/CVE-2025-1455.md): Royal Elementor Addons and Templates \<= 1.7.1012 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-1441](https://cve.now/CVE-2025-1441.md): Royal Elementor Addons and Templates \<= 1.7.1007 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2025-0393](https://cve.now/CVE-2025-0393.md): Royal Elementor Addons and Templates \<= 1.7.1006 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-37490](https://cve.now/CVE-2024-37490.md): WordPress Bard theme \<= 2.210 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-37478](https://cve.now/CVE-2024-37478.md): WordPress Ashe theme \<= 2.233 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-10798](https://cve.now/CVE-2024-10798.md): Royal Elementor Addons and Templates \<= 1.7.1003 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3)
- [CVE-2024-10532](https://cve.now/CVE-2024-10532.md): Bard Extra \<= 1.2.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import (CVSS 4.3)
- [CVE-2024-9777](https://cve.now/CVE-2024-9777.md): Ashe \<= 2.243 - Reflected Cross-Site Scripting via add\_query\_arg Parameter (CVSS 6.1)
- [CVE-2024-9830](https://cve.now/CVE-2024-9830.md): Bard \<= 2.216 - Reflected Cross-Site Scripting via add\_query\_arg Parameter (CVSS 6.1)
- [CVE-2024-9682](https://cve.now/CVE-2024-9682.md): Royal Elementor Addons and Templates \<= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget (CVSS 6.4)
- [CVE-2024-9668](https://cve.now/CVE-2024-9668.md): Royal Elementor Addons and Templates \<= 1.7.1001 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4)
- [CVE-2024-9059](https://cve.now/CVE-2024-9059.md): Royal Elementor Addons and Template \<= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget (CVSS 6.4)
- [CVE-2024-7417](https://cve.now/CVE-2024-7417.md): Royal Elementor Addons and Templates \<= 1.3.986 - Authenticated (Subscriber+) Private Post Disclosure (CVSS 4.3)
- [CVE-2022-4974](https://cve.now/CVE-2022-4974.md): Freemius SDK \<= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- [CVE-2024-8482](https://cve.now/CVE-2024-8482.md): Royal Elementor Addons and Templates \<= 1.3.986 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget (CVSS 6.4)
- [CVE-2024-5818](https://cve.now/CVE-2024-5818.md): Royal Elementor Addons and Templates \<= 1.3.980 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider Widget (CVSS 6.4)
- [CVE-2024-4488](https://cve.now/CVE-2024-4488.md): Royal Elementor Addons and Templates \<= 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-4489](https://cve.now/CVE-2024-4489.md): Royal Elementor Addons and Templates \<= 1.3.976 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploads (CVSS 6.4)
- [CVE-2024-4087](https://cve.now/CVE-2024-4087.md): Royal Elementor Addons and Templates \<= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting via Back to Top Widget (CVSS 6.4)
- [CVE-2024-4342](https://cve.now/CVE-2024-4342.md): Royal Elementor Addons and Templates \<= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-3887](https://cve.now/CVE-2024-3887.md): Royal Elementor Addons and Templates \<= 1.3.974 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Builder Widget (CVSS 5.4)
- [CVE-2024-1567](https://cve.now/CVE-2024-1567.md): Royal Elementor Addons and Templates \<= 1.3.94 - Unauthenticated Limited File Upload (CVSS 8.2)
- [CVE-2024-3675](https://cve.now/CVE-2024-3675.md): Royal Elementor Addons and Templates \<= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flip Carousel, Flip Box, Post Grid, and Taxonomy List Widget Attributes (CVSS 6.4)
- [CVE-2024-3889](https://cve.now/CVE-2024-3889.md): Royal Elementor Addons and Templates \<= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Accordion Title Tags (CVSS 6.4)
- [CVE-2024-2798](https://cve.now/CVE-2024-2798.md): Royal Elementor Addons and Templates \<= 1.3.971 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-2799](https://cve.now/CVE-2024-2799.md): Royal Elementor Addons and Templates \<= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags (CVSS 6.4)
- [CVE-2024-1500](https://cve.now/CVE-2024-1500.md): Royal Elementor Addons and Templates \<= 1.3.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Logo Widget (CVSS 5.4)
- [CVE-2024-0516](https://cve.now/CVE-2024-0516.md): Royal Elementor Addons and Templates \<= 1.3.87 - Missing Authorization via wpr\_update\_form\_action\_meta (CVSS 5.3)
- [CVE-2024-0512](https://cve.now/CVE-2024-0512.md): Royal Elementor Addons and Templates \<= 1.3.87 - Cross-Site Request Forgery via add\_to\_wishlist (CVSS 4.3)
- [CVE-2024-0514](https://cve.now/CVE-2024-0514.md): Royal Elementor Addons and Templates \<= 1.3.87 - Cross-Site Request Forgery via add\_to\_compare (CVSS 4.3)
- [CVE-2024-0515](https://cve.now/CVE-2024-0515.md): Royal Elementor Addons and Templates \<= 1.3.87 - Cross-Site Request Forgery via remove\_from\_compare (CVSS 4.3)
- [CVE-2024-0513](https://cve.now/CVE-2024-0513.md): Royal Elementor Addons and Templates \<= 1.3.87 - Cross-Site Request Forgery via remove\_from\_wishlist (CVSS 4.3)
- [CVE-2024-0442](https://cve.now/CVE-2024-0442.md): Royal Elementor Addons and Templates \<= 1.3.87 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-0511](https://cve.now/CVE-2024-0511.md): Royal Elementor Addons and Templates \<= 1.3.87 - Cross-Site Request Forgery via wpr\_update\_form\_action\_meta (CVSS 4.3)
- [CVE-2024-0835](https://cve.now/CVE-2024-0835.md): Royal Elementor Kit \<= 1.0.116 - Missing Authorization to Arbitrary Transient Update (CVSS 4.3)
- [CVE-2023-3709](https://cve.now/CVE-2023-3709.md): Royal Elementor Addons \<=1.3.70 - Unauthenticated MailChimp API Key Disclosure (CVSS 5.3)
- [CVE-2022-4707](https://cve.now/CVE-2022-4707.md): Royal Elementor Addons \<= 1.3.59 - Cross-Site Request Forgery to Menu Template creation (CVSS 4.3)
- [CVE-2022-4701](https://cve.now/CVE-2022-4701.md): Royal Elementor Addons \<= 1.3.59 - Insufficient Access Control to Plugin Activation (CVSS 4.3)
- [CVE-2022-4703](https://cve.now/CVE-2022-4703.md): Royal Elementor Addons \<= 1.3.59 - Insufficient Access Control to Import Deletion (CVSS 4.3)
- [CVE-2022-4705](https://cve.now/CVE-2022-4705.md): Royal Elementor Addons \<= 1.3.59 - Insufficient Access Control to Template Activation (CVSS 4.3)
- [CVE-2022-4704](https://cve.now/CVE-2022-4704.md): Royal Elementor Addons \<= 1.3.59 - Insufficient Access Control to Template Import (CVSS 5.4)
- [CVE-2022-4710](https://cve.now/CVE-2022-4710.md): Royal Elementor Addons \<= 1.3.59 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2022-4708](https://cve.now/CVE-2022-4708.md): Royal Elementor Addons \<= 1.3.59 - Insufficient Access Control to Template Conditions Modification (CVSS 4.3)
- [CVE-2022-4711](https://cve.now/CVE-2022-4711.md): Royal Elementor Addons \<= 1.3.59 - Insufficient Access Control to Menu Settings Update (CVSS 4.3)
- [CVE-2022-4702](https://cve.now/CVE-2022-4702.md): Royal Elementor Addons \<= 1.3.59 - Insufficient Access Control to Plugin Deactivation (CVSS 5.4)
- [CVE-2022-4700](https://cve.now/CVE-2022-4700.md): Royal Elementor Addons \<= 1.3.59 - Insufficient Access Control to Theme Activation (CVSS 5.4)
- [CVE-2022-4709](https://cve.now/CVE-2022-4709.md): Royal Elementor Addons \<= 1.3.59 - Insufficient Access Control to Template Kit Import (CVSS 4.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wproyal
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.