The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widgetGrid`, `widgetCountDown`, and `widgetInstagramFeed` methods in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Metrics
Affected Vendors & Products
References
History
Tue, 08 Jul 2025 18:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Royal-elementor-addons
Royal-elementor-addons royal Elementor Addons |
|
CPEs | cpe:2.3:a:royal-elementor-addons:royal_elementor_addons:*:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Royal-elementor-addons
Royal-elementor-addons royal Elementor Addons |
Mon, 14 Apr 2025 18:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Sat, 12 Apr 2025 08:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widgetGrid`, `widgetCountDown`, and `widgetInstagramFeed` methods in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
Title | Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated DOM-Based (Contributor+) Stored Cross-Site Scripting | |
Weaknesses | CWE-79 | |
References |
|
|
Metrics |
cvssV3_1
|

Status: PUBLISHED
Assigner: Wordfence
Published: 2025-04-12T08:22:40.950Z
Updated: 2025-04-14T18:05:48.768Z
Reserved: 2025-02-18T19:47:03.889Z
Link: CVE-2025-1456

Updated: 2025-04-13T02:30:30.701Z

Status : Analyzed
Published: 2025-04-12T09:15:16.600
Modified: 2025-07-08T18:21:58.743
Link: CVE-2025-1456

No data.