The Royal Elementor Addons and Templates plugin is vulnerable to Cross‑Site Request Forgery because the wpr_filter_woo_products function lacks proper nonce validation. An unauthenticated attacker can forge a request that injects malicious JavaScript into the page response, resulting in reflected cross‑site scripting when a privileged user follows the forged link.

The affected product is Royal Elementor Addons for Elementor – Addons and Templates Kit for Elementor, versions up to and including 1.7.1007. The plugin runs on WordPress sites and is identified by the CPE royal‑elementor‑addons. No other vendors or products are listed as affected.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack path requires an unauthenticated attacker to lure a site administrator into clicking a forged link that triggers the vulnerable function, thereby injecting malicious JavaScript into the page response.