CVE-2025-11363
CVE-2025-11363
Medium · published December 15, 2025
What it is
The Royal Addons for Elementor WordPress plugin before 1.7.1037 does not have proper authorisation, allowing unauthenticated users to upload media files via the wpr_addons_upload_file action.
The record
Technical detail
- CVSS v3.1
- 5.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00287 · 20.2th percentile
- Published
- 2025-12-15T11:15Z
References (1)
EPSS history
Timeline