VulnTitan VulnTitan Security command center
Vulnerability Report
Plugin Medium Patch path listed CVE-2022-4705

Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Activation

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to finalize activation of preset site configuration templates, which can be chosen and imported via a separate action documented in CVE-2022-4704.

Quick Answer

CVE-2022-4705 is a medium severity with CVSS 4.3 Vulnerability issue affecting the Plugin Royal Addons for Elementor – Addons and Templates Kit for Elementor. It affects Versions up to 1.3.59 and is fixed in 1.3.60.

Back to Feed View Plugin Hub Open CVE Reference
Published
Jan 10, 2023
Last Updated
Jan 22, 2024
Slug
royal-elementor-addons
Operational Summary

What the operator needs to know

Share Email
Patch Status
Patched release is available
Remediation
Update to version 1.3.60, or a newer patched version
Operator Briefing

CVE-2022-4705 is tracked for the Plugin Royal Addons for Elementor – Addons and Templates Kit for Elementor as medium severity with CVSS 4.3. The affected range is Versions up to 1.3.59. Update Royal Addons for Elementor – Addons and Templates Kit for Elementor to 1.3.60 or newer where that version is compatible with the site.

Issue Type
Vulnerability
Primary Fixed Version
1.3.60
Primary Affected Range
Versions up to 1.3.59
Tracking ID
CVE-2022-4705
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/0a941aef-85f6-4719-b6ab-ace77a03e93e?source=api-prod
Detailed Metadata
Software Type Plugin
Software Slug
royal-elementor-addons View on wordpress.org
CVE CVE-2022-4705
Patched Versions
1.3.60
Affected Versions
Versions up to 1.3.59
Related CVE Cluster

Related CVEs for Royal Addons for Elementor – Addons and Templates Kit for Elementor

These internal links group the same WordPress plugin by CVE, issue type, severity, and patch status so operators and search engines can connect the full vulnerability cluster.

Critical CVE-2023-5360 1.3.79 Oct 09, 2023
CVE-2023-5360 Royal Addons for Elementor – Addons and Templates Kit for Elementor Remote Code Execution

Royal Elementor Addons and Templates <= 1.3.78 - Unauthenticated Arbitrary File Upload

High CVE-2025-13067 1.7.1050 Mar 10, 2026
CVE-2025-13067 Royal Addons for Elementor – Addons and Templates Kit for Elementor Remote Code Execution

Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass

High CVE-2024-1567 1.3.95 Apr 19, 2024
CVE-2024-1567 Royal Addons for Elementor – Addons and Templates Kit for Elementor Remote Code Execution

Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload

High CVE-2022-4102 1.3.56 Dec 15, 2022
CVE-2022-4102 Royal Addons for Elementor – Addons and Templates Kit for Elementor Cross-Site Request Forgery

Royal Elementor Addons <= 1.3.55 - Cross-Site Request Forgery

High CVE-2022-4102 1.3.56 Dec 15, 2022
CVE-2022-4102 Royal Addons for Elementor – Addons and Templates Kit for Elementor Authorization Bypass

Royal Elementor Addons <=1.3.55 - Authenticated (Subscriber+) Arbitrary Post Deletion

Medium CVE-2022-4103 1.3.56 Dec 15, 2022
CVE-2022-4103 Royal Addons for Elementor – Addons and Templates Kit for Elementor Authorization Bypass

Royal Elementor Addons <=1.3.55 - Missing Authorization to Subscriber+ Arbitrary Post Creation

Medium CVE-2026-5428 1.7.1057 Apr 23, 2026
CVE-2026-5428 Royal Addons for Elementor – Addons and Templates Kit for Elementor Stored Cross-Site Scripting

Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field

Medium CVE-2026-5162 1.7.1057 Apr 16, 2026
CVE-2026-5162 Royal Addons for Elementor – Addons and Templates Kit for Elementor Stored Cross-Site Scripting

Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget

Licensing Notices

This record contains material that is subject to copyright

DEFIANT
Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more

MITRE
Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more