CVE-2026-13402
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Royal Addons for Elementor WordPress plugin before version 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from non-public navigation menu items.
Risk Assessment
The organization risks exposure of confidential content, such as page drafts or designs, which may contain sensitive data or unfinished features, potentially leading to a breach of confidentiality and information integrity.
Recommendation
Immediately update the Royal Addons for Elementor plugin to version 1.7.1063 or later, which includes a security fix preventing unauthorized access to private templates.
Other vulnerabilities in Royal Addons for Elementor
See all- CVE-2026-19226Medium
The Royal Addons for Elementor WordPress plugin before version 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- CVE-2026-13406Medium
The Royal Addons for Elementor WordPress plugin before version 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy. This allows unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies.
- CVE-2026-13404Medium
The Royal Addons for Elementor WordPress plugin before version 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID. This allows unauthenticated users to modify that metadata on any post, including private and draft posts.
- CVE-2026-13405Medium
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitize custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and on WordPress Multisite, non-super subsite administrators who do not otherwise hold code-execution capabilities) to execute arbitrary PHP code.
- CVE-2026-19217Medium
The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- CVE-2026-0664Medium
The Royal Addons for Elementor plugin for WordPress up to 1.7.1049 has a stored XSS vulnerability via the 'button_text' parameter. Authentication at contributor level or above is required.
Original NVD description (English source)
The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from non-public navigation menu items.