CVE-2022-4707 Royal Elementor Addons <= 1.3.59 - Cross-Site Request Forgery to Menu Template creation

What is CVE-2022-4707?

CVE-2022-4707 is a medium-severity vulnerability in Royal-Elementor-Addons Royal Elementor Addons, published on 10 Jan 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This is due to missing nonce validation in the 'wpr_create_mega_menu_template' AJAX function. This allows unauthenticated attackers to create Mega Menu templates, granted they can trick an administrator into performing an action, such as clicking a link.

Weakness: CWE-352

Which versions are affected by CVE-2022-4707?

It affects 1 product.

Products include Royal-Elementor-Addons Royal Elementor Addons.

How do I fix CVE-2022-4707?

No fix has been published for CVE-2022-4707 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-4707 being exploited?

There is no known exploitation of CVE-2022-4707 in the wild and no public exploit code.

Other vulnerabilities in Royal-Elementor-Addons Royal Elementor Addons

• CVE-2023-5360 Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload Critical 9.8
• CVE-2024-1567 Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload High 8.2
• CVE-2023-5922 Royal Elementor Addons and Templates < 1.3.81 - Unauthenticated Arbitrary Post Read High 7.5
• CVE-2024-56226 WordPress Royal Elementor Addons plugin <= 1.7.1001 - Reflected Cross Site Scripting (XSS) vulnerability High 7.1
• CVE-2025-39361 WordPress Royal Elementor Addons plugin <= 1.7.1017 - Cross Site Scripting (XSS) vulnerability Medium 6.5

All Royal-Elementor-Addons Royal Elementor Addons vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-552w-fg8f-29x6.