CVE-2026-13406
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Royal Addons for Elementor WordPress plugin before version 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy. This allows unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies.
Risk Assessment
The risk is information disclosure about non-public taxonomies, potentially revealing sensitive data or content structure. Attackers could use this information for further attacks or privacy breaches.
Recommendation
Immediately update the Royal Addons for Elementor plugin to version 1.7.1066 or later. Also check for any unauthorized access to taxonomy data.
Other vulnerabilities in Royal Addons for Elementor
See all- CVE-2026-19226Medium
The Royal Addons for Elementor WordPress plugin before version 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- CVE-2026-13404Medium
The Royal Addons for Elementor WordPress plugin before version 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID. This allows unauthenticated users to modify that metadata on any post, including private and draft posts.
- CVE-2026-13405Medium
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitize custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and on WordPress Multisite, non-super subsite administrators who do not otherwise hold code-execution capabilities) to execute arbitrary PHP code.
- CVE-2026-19217Medium
The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- CVE-2026-13402Medium
The Royal Addons for Elementor WordPress plugin before version 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from non-public navigation menu items.
- CVE-2026-0664Medium
The Royal Addons for Elementor plugin for WordPress up to 1.7.1049 has a stored XSS vulnerability via the 'button_text' parameter. Authentication at contributor level or above is required.
Original NVD description (English source)
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies.