CVE-2024-1567highCWE-434

CVE-2024-1567: high-severity vulnerability in wproyal Royal Addons for Elementor – Addons…

Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload

Published · Updated

Follow this CVE+ Monitor Royal Addons for Elementor – Addons and Templates Kit for Elementor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 1.1%
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in the 'file_validity' function in all versions up to, and including, 1.3.94. This makes it possible for unauthenticated attackers to upload dangerous file types such as .svgz on the affected site's server which may make cross-site scripting or remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Affected products
wproyal · Royal Addons for Elementor – Addons and Templates Kit for Elementor
Related CVEs — wproyal Royal Addons for Elementor – Addons…

In the same product, most dangerous first.

CVE-2022-4703MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Import DeletionEPSS 1.0%CVE-2022-4700MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Theme ActivationEPSS 0.9%CVE-2022-4704MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template ImportEPSS 0.8%CVE-2022-4702MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin DeactivationEPSS 0.8%CVE-2022-4701MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin ActivationEPSS 0.8%CVE-2022-4710MEDIUMRoyal Elementor Addons <= 1.3.59 - Reflected Cross-Site ScriptingEPSS 0.8%