Cross-Site Scripting Vulnerability in Royal Elementor Addons by WProyal
CVE-2025-39361

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Royal Elementor Addons
Vendor
CVE Published:
7 May 2025

What is CVE-2025-39361?

The Royal Elementor Addons for WordPress has a Cross-Site Scripting (XSS) vulnerability that permits the injection of malicious scripts into web pages. This flaw stems from improper handling of user input, leading to potential exploitation. Attackers could leverage this vulnerability to execute arbitrary JavaScript in the context of the affected website, compromising user data and site integrity. It is crucial for users of this plugin to update to the latest version to mitigate risks associated with this vulnerability.

Affected Version(s)

Royal Elementor Addons <= 1.7.1017

References

https://patchstack.com/database/wordpress/plugin/royal-el...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth)
.
CVE-2025-39361 : Cross-Site Scripting Vulnerability in Royal Elementor Addons by WProyal