CVE-2025-11363

Medium · 5.3

CVSS

5.3

EPSS

0.3%

Published

Dec 15, 2025

CISA due date

—

The record

The Royal Addons for Elementor WordPress plugin before 1.7.1037 does not have proper authorisation, allowing unauthenticated users to upload media files via the wpr_addons_upload_file action.

Affected packages

Ecosystem	Package	Introduced	Fixed