Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2025-1456: Royal Elementor Plugin Exposes WordPress Sites to Malicious Script Injection
CVE-2025-1456 · published 1 year ago
Summary
The Royal Elementor Addons and Templates plugin for WordPress allows attackers to inject malicious scripts into website pages, potentially compromising user data and site security. This vulnerability affects all versions up to 1.7.1012, and to mitigate it, update the plugin to a fixed version or remove it if not essential. If you have Contributor-level access or higher, be cautious when creating and editing pages that use these vulnerable widgets.
What to do
- Update royal-elementor-addons royal_elementor_addons to version 1.7.1013 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| royal-elementor-addons | royal_elementor_addons |
< 1.7.1013 cpe:2.3:a:royal-elementor-addons:royal_elementor_addons:*:*:*:*:*:wordpress:*:* |
Original advisory text
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widgetGrid`, `widgetCountDown`, and `widgetInstagramFeed` methods in all versions...
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widgetGrid`, `widgetCountDown`, and `widgetInstagramFeed` methods in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published12 Apr 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-1456 · NVD
Track software like this
Free during beta