Royal-elementor-addons

Royal Elementor Addons

58 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.3

CVE-2024-0511

  • EPSS 0.07%
  • Veröffentlicht 08.02.2024 06:15:51
  • Zuletzt bearbeitet 21.11.2024 08:46:45

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the wpr_update_form_action_meta function. ...

7.5

CVE-2023-5922

Exploit
  • EPSS 1.05%
  • Veröffentlicht 16.01.2024 16:15:13
  • Zuletzt bearbeitet 02.06.2025 15:15:25

The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and REST endpoint, currently disabled in the plugin) have the right to do so, allowing unauthenticated users to acc...

9.8

CVE-2023-5360

Exploit
  • EPSS 93.48%
  • Veröffentlicht 31.10.2023 14:15:12
  • Zuletzt bearbeitet 21.11.2024 08:41:36

The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.

8.8

CVE-2022-47175

  • EPSS 0.07%
  • Veröffentlicht 06.10.2023 13:15:12
  • Zuletzt bearbeitet 21.11.2024 07:31:38

Cross-Site Request Forgery (CSRF) vulnerability in P Royal Royal Elementor Addons and Templates plugin <= 1.3.75 versions.

5.3

CVE-2023-3709

  • EPSS 0.18%
  • Veröffentlicht 18.07.2023 03:15:56
  • Zuletzt bearbeitet 21.11.2024 08:17:53

The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 1.3.70 due to the plugin adding the API key to the source code of any page running the MailChimp block. This makes i...

4.3

CVE-2022-4711

Exploit
  • EPSS 0.15%
  • Veröffentlicht 10.01.2023 17:15:11
  • Zuletzt bearbeitet 21.11.2024 07:35:46

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscribe...

6.1

CVE-2022-4710

  • EPSS 2.43%
  • Veröffentlicht 10.01.2023 17:15:11
  • Zuletzt bearbeitet 21.11.2024 07:35:46

The Royal Elementor Addons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.59, due to due to insufficient input sanitization and output escaping of the 'wpr_ajax_search_link_target' parameter...

6.5

CVE-2022-4709

  • EPSS 0.15%
  • Veröffentlicht 10.01.2023 17:15:11
  • Zuletzt bearbeitet 21.11.2024 07:35:46

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscribe...

6.5

CVE-2022-4708

  • EPSS 0.15%
  • Veröffentlicht 10.01.2023 17:15:11
  • Zuletzt bearbeitet 21.11.2024 07:35:46

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscrib...

6.5

CVE-2022-4707

  • EPSS 0.09%
  • Veröffentlicht 10.01.2023 17:15:11
  • Zuletzt bearbeitet 21.11.2024 07:35:46

The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This is due to missing nonce validation in the 'wpr_create_mega_menu_template' AJAX function. This allows unauthenti...