Vulnerabilities (CVE)

Filtered by vendor Royal-elementor-addons Subscribe
Total 24 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-4711 1 Royal-elementor-addons 1 Royal Elementor Addons 2024-02-04 N/A 4.3 MEDIUM
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to enable and modify Mega Menu settings for any menu item.
CVE-2022-4702 1 Royal-elementor-addons 1 Royal Elementor Addons 2024-02-04 N/A 6.5 MEDIUM
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to deactivate every plugin on the site unless it is part of an extremely limited hardcoded selection. This also switches the site to the 'royal-elementor-kit' theme, potentially resulting in availability issues.
CVE-2022-4701 1 Royal-elementor-addons 1 Royal Elementor Addons 2024-02-04 N/A 8.8 HIGH
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to activate the 'contact-form-7', 'media-library-assistant', or 'woocommerce' plugins if they are installed on the site.
CVE-2022-4704 1 Royal-elementor-addons 1 Royal Elementor Addons 2024-02-04 N/A 8.1 HIGH
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to import preset site configuration templates including images and settings.