Cross-Site Request Forgery in Royal Elementor Addons and Templates Plugin for WordPress

CVE-2025-0393

What is CVE-2025-0393?

The Royal Elementor Addons and Templates plugin for WordPress is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability due to improper nonce validation in the wpr_filter_grid_posts() function. This flaw allows unauthenticated attackers to exploit the vulnerability by tricking site administrators into performing unintended actions, potentially enabling the injection of malicious scripts. The issue is present in all versions up to and including 1.7.1006, making it critical for users to update their installations to mitigate the risk of exploitation.

References