tadrik Free store check

Plugin security / Royal Addons for Elementor

Royal Addons for Elementor vulnerability: is your WooCommerce store affected?

Royal Addons for Elementor has 17 serious security holes rated 7 or higher out of 10 that someone can use with no login or with only a customer account. The newest was published on 14 September 2026. Every one is fixed: update to 1.7.1069 or newer.

Short answer: your store is affected if it runs Royal Addons for Elementor older than 1.7.1069. Update to 1.7.1069 or newer, on a copy of the store first if you can.

In our check of 3,600 live UK and US WooCommerce stores (31 October 2026 to 1 November 2026), 7 were running a version of Royal Addons for Elementor with a serious hole that already had a fix. How we checked.

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

  1. Code execution

    Someone could run their own code on your server.

    Score 7.6 (high)needs only a customer accountAffected: older than 1.7.1069Fixed in 1.7.1069Published 14 September 2026CVE-2026-111851

    Advisory: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor...

  2. Server-side request forgery

    Someone could make your server send requests on their behalf.

    Score 8.8 (high)needs only a customer accountAffected: older than 1.7.1065Fixed in 1.7.1065Published 15 August 2026CVE-2026-17123

    Advisory: The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhook_url' setting.

  3. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.2 (high)no login neededAffected: older than 1.7.1057Fixed in 1.7.1057Published 4 May 2026CVE-2026-4803

    Advisory: The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in the wpr_update_form_action_meta AJAX action in all versions up to, and including, 1.7.1056.

  4. Server-side request forgery

    Someone could make your server send requests on their behalf.

    Score 7.2 (high)no login neededAffected: older than 1.7.1058Fixed in 1.7.1058Published 1 May 2026CVE-2026-6229

    Advisory: The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057.

  5. File upload

    Someone could upload files to your server, which can include code.

    Score 8.8 (high)needs only a customer accountAffected: older than 1.7.1050Fixed in 1.7.1050Published 10 March 2026CVE-2025-13067

    Advisory: The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049.

  6. Code execution

    Someone could run their own code on your server.

    Score 8.2 (high)no login neededAffected: older than 1.7.1053Fixed in 1.7.1053Published 26 February 2026CVE-2026-28135

    Advisory: Inclusion of Functionality from Untrusted Control Sphere vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects...

  7. Cross-site request forgery

    Someone could trick a logged-in admin into making a change.

    Score 8.8 (high)no login neededAffected: older than 1.7.1008Fixed in 1.7.1008Published 18 February 2025CVE-2025-1441

    Advisory: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1007.

  8. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.1 (high)no login neededAffected: older than 1.7.1002Fixed in 1.7.1002Published 19 December 2024CVE-2024-56226

    Advisory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Reflected XSS.This issue affects Royal Elementor...

  9. Account takeover

    Someone could log in as another user, an admin included, without their password.

    Score 9.8 (critical)no login neededAffected: older than 1.3.95Fixed in 1.3.95Published 22 April 2024CVE-2024-32786

    Advisory: Authentication Bypass by Spoofing vulnerability in WP Royal Royal Elementor Addons allows Functionality Bypass.This issue affects Royal Elementor Addons: from n/a through 1.3.93.

  10. File upload

    Someone could upload files to your server, which can include code.

    Score 9.8 (critical)no login neededAffected: older than 1.3.95Fixed in 1.3.95Published 19 April 2024CVE-2024-1567

    Advisory: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in the 'file_validity' function in all versions up to, and including, 1.3.94.

  11. Data exposure

    Information meant to stay private could be read.

    Score 7.5 (high)no login neededAffected: older than 1.3.81Fixed in 1.3.81Published 6 December 2023CVE-2023-5922

    Advisory: The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and REST endpoint, currently disabled in the plugin) have the right to do so,...

  12. Code execution

    Someone could run their own code on your server.

    Score 9.8 (critical)no login neededAffected: older than 1.3.79Fixed in 1.3.79Published 9 October 2023CVE-2023-5360

    Advisory: The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.

  13. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.1 (high)no login neededAffected: older than 1.3.71Fixed in 1.3.71Published 18 July 2023e2b7f1d4921264a8719303c6aee7476dcddcb8f1

  14. Missing permission check

    An action that should need permission could be done without it.

    Score 8.8 (high)needs only a customer accountAffected: older than 1.3.60Fixed in 1.3.60Published 10 January 2023CVE-2022-4701

    Advisory: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up to, and including, 1.3.59.

  15. Missing permission check

    An action that should need permission could be done without it.

    Score 8.8 (high)needs only a customer accountAffected: older than 1.3.60Fixed in 1.3.60Published 10 January 2023CVE-2022-4700

    Advisory: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to, and including, 1.3.59.

  16. Missing permission check

    An action that should need permission could be done without it.

    Score 8.1 (high)needs only a customer accountAffected: older than 1.3.60Fixed in 1.3.60Published 10 January 2023CVE-2022-4704

    Advisory: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, and including, 1.3.59.

  17. Missing permission check

    An action that should need permission could be done without it.

    Score 8.1 (high)needs only a customer accountAffected: older than 1.3.60Fixed in 1.3.60Published 10 January 2023CVE-2022-4703

    Advisory: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to, and including, 1.3.59.

How to check your version

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Find Royal Addons for Elementor. The version number is under its name. If it is lower than 1.7.1069, your store is affected.
  3. No login to hand? Open https://yourstore.com/wp-content/plugins/royal-elementor-addons/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

  1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
  2. On the copy, update Royal Addons for Elementor to 1.7.1069 or newer: Dashboard > Updates, or Update now on the Plugins page.
  3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
  4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use Royal Addons for Elementor.
  5. If everything works, make the same update on the live store and place one more test order.
  6. If you no longer use Royal Addons for Elementor, delete it instead of leaving it deactivated.

Not sure, or no time?

Get a free check of your store: we look at its public pages for plugins with known holes, and reply within one working day. Or we fix it for you: we update your store on a copy, place a test order, and only then change the live store, for a fixed £99 / $119.

Free store check Fix it for me on a copy

Questions

Which Royal Addons for Elementor version fixes it?
Version 1.7.1069 or newer fixes all 17 issues on this page.
How do I know if my store is affected?
Your store is affected if it runs Royal Addons for Elementor older than 1.7.1069. In WordPress, open Plugins and read the version under Royal Addons for Elementor. Without logging in, open yourstore.com/wp-content/plugins/royal-elementor-addons/readme.txt and read the Stable tag line.
I don't use Royal Addons for Elementor any more. Is a deactivated copy safe?
Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.
Can someone fix it for me?
Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 3 November 2026.