CVE-2025-63044

MediumCVSS 6.5

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

DOM-Based XSS vulnerability in the Xpro Elementor Addons plugin allows injection of malicious script into the page generated by the plugin. An attacker can exploit this to execute script in the victim's browser.

Risk Assessment

Risk of session hijacking, data theft, or unauthorized actions in the victim's context.

Recommendation

Update the Xpro Elementor Addons plugin to a version newer than 1.4.19.1 if a patch is available.

Other vulnerabilities in Xpro Elementor Addons

CVE-2026-45214High
The Xpro Elementor Addons plugin has an SQL Injection vulnerability that allows for Blind SQL Injection attacks. This issue affects versions from n/a through 1.5.1.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows DOM-Based XSS.This issue affects Xpro Elementor Addons: from n/a through <= 1.4.19.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS