Royal Elementor Kit Vulnerabilities

The Royal Elementor Kit theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.116. This is due to missing or incorrect nonce validation on the dismissed_handler() function. This makes it possible for unauthenticated attackers to dismiss notices via a forged request gr...

CVSS:

4.3

Affected:

up to 1.0.116

Fixed in:

1.0.117

Disclosed:

Apr 22, 2024

CVE-2024-32773 on NVD →

The Royal Elementor Kit theme for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the dismissed_handler function in all versions up to, and including, 1.0.116. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrar...

CVSS:

4.3

Affected:

up to 1.0.116

Fixed in:

1.0.117

Disclosed:

Feb 5, 2024

CVE-2024-0835 on NVD →