CVE-2025-11363

—

CVSS 3.1

5.3 medium

EPSS

<1%p20

Published

Dec 15, 2025 (Dec 15, 2025)

Modified

Jun 17, 2026

Description

The Royal Addons for Elementor WordPress plugin before 1.7.1037 does not have proper authorisation, allowing unauthenticated users to upload media files via the wpr_addons_upload_file action.

Ecosystems: WordPress
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.