CVE-2026-17585
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the 'wpr_keyword' parameter. An unauthenticated attacker can extract arbitrary postmeta values from all published posts via character-by-character substring matching across the entire wp_postmeta table. The required nonce is emitted publicly via wp_localize_script on any frontend page that loads a Royal Elementor widget, so no authenticated session or prior action is needed.
Risk Assessment
An unauthenticated attacker can read arbitrary post metadata, potentially exposing sensitive information stored in postmeta. The risk of data confidentiality breach is high.
Recommendation
Update the plugin to a version newer than 1.7.1066 as soon as it becomes available, and consider restricting public access to post metadata.
Other vulnerabilities in Royal Addons for Elementor
See all- CVE-2026-19226Medium
The Royal Addons for Elementor WordPress plugin before version 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- CVE-2026-13406Medium
The Royal Addons for Elementor WordPress plugin before version 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy. This allows unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies.
- CVE-2026-13404Medium
The Royal Addons for Elementor WordPress plugin before version 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID. This allows unauthenticated users to modify that metadata on any post, including private and draft posts.
- CVE-2026-13405Medium
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitize custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and on WordPress Multisite, non-super subsite administrators who do not otherwise hold code-execution capabilities) to execute arbitrary PHP code.
- CVE-2026-19217Medium
The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- CVE-2026-13402Medium
The Royal Addons for Elementor WordPress plugin before version 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from non-public navigation menu items.
- CVE-2026-0664Medium
The Royal Addons for Elementor plugin for WordPress up to 1.7.1049 has a stored XSS vulnerability via the 'button_text' parameter. Authentication at contributor level or above is required.
Original NVD description (English source)
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the 'wpr_keyword' parameter. This makes it possible for unauthenticated attackers to extract arbitrary postmeta values from all published posts via character-by-character substring matching across the entire wp_postmeta table. The required nonce is emitted publicly via wp_localize_script on any frontend page that loads a Royal Elementor widget, meaning no authenticated session or prior action is needed to obtain it.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS