The Royal Elementor Addons and Templates plugin for WordPress suffers from a CSRF vulnerability (CWE-352) in the 'wpr_filter_woo_products' function due to missing or incorrect nonce validation. This flaw allows attackers to craft requests that, when executed by an authenticated site administrator, can lead to injection of malicious scripts. The vulnerability affects all versions up to 1.7.1007. The CVSS 3.1 vector indicates the attack requires no privileges but does require user interaction and can result in partial confidentiality and integrity impact. No patch or remediation details are currently available.

Successful exploitation could allow an attacker to perform unauthorized actions on behalf of a site administrator, potentially injecting malicious scripts that compromise confidentiality and integrity of the affected site. There is no indication of availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with links and requests that could trigger this vulnerability. Monitoring for updates from the vendor or security advisories is recommended.