The WP Royal Royal Elementor Addons plugin suffers from an improper restriction of XML External Entity (XXE) references, allowing XML injection attacks. This affects versions up to and including 1.3.980. The vulnerability can be exploited remotely over the network but requires high privileges on the system and does not need user interaction. The impact includes potential high confidentiality and availability damage. No vendor advisory or patch information is available at this time.

Successful exploitation of this vulnerability could lead to disclosure of confidential information and disruption of service (availability impact). The attack requires high privileges, limiting the ease of exploitation. There are no known active exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from WP Royal and consider restricting access to the plugin functionality to trusted users with high privileges to reduce risk.