CVE-2026-13404
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Royal Addons for Elementor WordPress plugin before version 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID. This allows unauthenticated users to modify that metadata on any post, including private and draft posts.
Risk Assessment
The risk includes the ability to manipulate post meta data, potentially leading to falsified statistics, content integrity issues, or impact on post visibility. Attackers could also disrupt tracking functionality.
Recommendation
Update the Royal Addons for Elementor plugin to version 1.7.1066 or later. Also verify the integrity of post meta data and consider adding additional security measures.
Other vulnerabilities in Royal Addons for Elementor
See all- CVE-2026-19226Medium
The Royal Addons for Elementor WordPress plugin before version 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- CVE-2026-13406Medium
The Royal Addons for Elementor WordPress plugin before version 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy. This allows unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies.
- CVE-2026-13405Medium
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitize custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and on WordPress Multisite, non-super subsite administrators who do not otherwise hold code-execution capabilities) to execute arbitrary PHP code.
- CVE-2026-19217Medium
The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- CVE-2026-13402Medium
The Royal Addons for Elementor WordPress plugin before version 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from non-public navigation menu items.
- CVE-2026-0664Medium
The Royal Addons for Elementor plugin for WordPress up to 1.7.1049 has a stored XSS vulnerability via the 'button_text' parameter. Authentication at contributor level or above is required.
Original NVD description (English source)
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that metadata on any post, including private and draft posts.