CVE-2025-0393

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1006. This is due to missing or incorrect nonce validation on the wpr_filter_grid_posts() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1006/classes/modules/wpr-filter-grid-posts.php#L1260Product
• https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1006/classes/modules/wpr-filter-grid-posts.php#L391Product
• https://plugins.trac.wordpress.org/changeset/3220959/Patch
• https://wordpress.org/plugins/royal-elementor-addons/#developersRelease Notes
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a8e34c05-7431-4acd-91f3-aab5e66f61ad?source=cveThird Party Advisory

Published

Jan 14, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-0374When etcupdate encounters conflicts while merging files, it …6.5
• CVE-2025-0376An XSS vulnerability exists in GitLab CE/EE affecting all ve…6.1
• CVE-2025-0377HashiCorp’s go-slug library is vulnerable to a zip-slip styl…9.1
• CVE-2025-0390A vulnerability classified as critical was found in Guangzho…7.5
• CVE-2025-0391A vulnerability, which was classified as critical, has been …8.8
• CVE-2025-0392A vulnerability, which was classified as critical, was found…8.8
• CVE-2025-0394The WordPress CRM, Email & Marketing Automation for WordPres…8.8
• CVE-2025-0395When the assert() function in the GNU C Library versions 2.1…6.2
• CVE-2025-0396A vulnerability, which was classified as critical, has been …8.5
• CVE-2025-0397A vulnerability, which was classified as problematic, was fo…5.3
• CVE-2025-0398A vulnerability has been found in longpi1 warehouse 1.0 and …5.1
• CVE-2025-0399A vulnerability was found in StarSea99 starsea-mall 1.0. It …7.2