Extension WordPress
Vulnérabilités Royal Addons for Elementor – Addons and Templates Kit for Elementor, page 4
Cette page rassemble les failles publiées pour Royal Addons for Elementor – Addons and Templates Kit for Elementor, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Royal Addons for Elementor – Addons and Templates Kit for Elementor
82 fiches
Royal Elementor Addons and Templates <= 1.3.87 – Cross-Site Request Forgery via remove_from_wishlist
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the remove_from_wishlist function. This makes…
*-1.3.87
1.3.88
07/02/2024
Royal Elementor Addons and Templates <= 1.3.80 – Missing Authorization to Private/Password Protected Post Read
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpr_get_page_content AJAX action in all versions up to, and including, 1.3.80. This makes it…
*-1.3.80
1.3.81
06/12/2023
Royal Elementor Addons and Templates <= 1.3.78 – Unauthenticated Arbitrary File Upload
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.3.78. This is due to insufficient file type validation in the handle_file_upload() function called via AJAX…
*-1.3.78
1.3.79
09/10/2023
Royal Elementor Addons <= 1.3.75 – Cross-Site Request Forgery
The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.75. This is due to missing or incorrect nonce validation on several functions including wpr_rating_dismiss_notice, wpr_rating_already_rated, wpr_pro_features_dismiss_notice. This makes…
*-1.3.75
1.3.76
22/08/2023
Freemius SDK <= 2.5.9 – Reflected Cross-Site Scripting via fs_request_get
The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
1.3-1.3.70
1.3.71
18/07/2023
Royal Elementor Addons <=1.3.70 – Unauthenticated MailChimp API Key Disclosure
The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 1.3.70 due to the plugin adding the API key to the source code of any page running the…
*-1.3.70
1.3.71
17/07/2023
Royal Elementor Addons <= 1.3.59 – Insufficient Access Control to Template Kit Import
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to import and…
*-1.3.59
1.3.60
10/01/2023
Royal Elementor Addons <= 1.3.59 – Insufficient Access Control to Theme Activation
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to activate the…
*-1.3.59
1.3.60
10/01/2023
Royal Elementor Addons <= 1.3.59 – Insufficient Access Control to Plugin Deactivation
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to deactivate every…
*-1.3.59
1.3.60
10/01/2023
Royal Elementor Addons <= 1.3.59 – Insufficient Access Control to Menu Settings Update
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to enable and…
*-1.3.59
1.3.60
10/01/2023
Royal Elementor Addons <= 1.3.59 – Insufficient Access Control to Template Conditions Modification
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to modify the…
*-1.3.59
1.3.60
10/01/2023
Royal Elementor Addons <= 1.3.59 – Reflected Cross-Site Scripting
The Royal Elementor Addons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.59, due to due to insufficient input sanitization and output escaping of the 'wpr_ajax_search_link_target' parameter in the 'data_fetch' function.…
*-1.3.59
1.3.60
10/01/2023
Royal Elementor Addons <= 1.3.59 – Insufficient Access Control to Template Import
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to import preset…
*-1.3.59
1.3.60
10/01/2023
Royal Elementor Addons <= 1.3.59 – Insufficient Access Control to Import Deletion
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to reset previously…
*-1.3.59
1.3.60
10/01/2023
Royal Elementor Addons <= 1.3.59 – Insufficient Access Control to Plugin Activation
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to activate the…
*-1.3.59
1.3.60
10/01/2023
Royal Elementor Addons <= 1.3.59 – Cross-Site Request Forgery to Menu Template creation
The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This is due to missing nonce validation in the 'wpr_create_mega_menu_template' AJAX function. This allows unauthenticated attackers to create…
*-1.3.59
1.3.60
10/01/2023
Royal Elementor Addons <= 1.3.59 – Insufficient Access Control to Template Activation
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to finalize activation…
*-1.3.59
1.3.60
10/01/2023
Royal Elementor Addons <=1.3.55 – Missing Authorization to Subscriber+ Arbitrary Post Creation
The Royal Elementor Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check during template creation in the function wpr_create_template in versions up to, and including, 1.3.55. Furthermore, the plugin does not verify…
*-1.3.55
1.3.56
15/12/2022
Royal Elementor Addons <=1.3.55 – Authenticated (Subscriber+) Arbitrary Post Deletion
The Royal Elementor Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check during template deletion in the function wpr_create_template in versions up to, and including, 1.3.55. Furthermore, the plugin does not verify…
*-1.3.55
1.3.56
15/12/2022
Royal Elementor Addons <= 1.3.55 – Cross-Site Request Forgery
The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.55. This is due to missing or incorrect nonce validation on the wpr_delete_template and wpr_create_template functions. This makes it…
*-1.3.55
1.3.56
15/12/2022
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.