CVE-2026-114177
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Xpro Elementor Addons plugin (versions up to and including 1.7.10) is vulnerable to Cross-Site Request Forgery (CSRF). The flaw allows an attacker to force an authenticated user to perform unintended actions.
Risk Assessment
An attacker could trick a site administrator into performing unintended operations, potentially leading to unauthorized changes in the WordPress configuration.
Recommendation
Update the Xpro Elementor Addons plugin to a version later than 1.7.10.
Other vulnerabilities in Xpro Elementor Addons
See all- CVE-2026-45214High
The Xpro Elementor Addons plugin has an SQL Injection vulnerability that allows for Blind SQL Injection attacks. This issue affects versions from n/a through 1.5.1.
- CVE-2025-63044Medium
DOM-Based XSS vulnerability in the Xpro Elementor Addons plugin allows injection of malicious script into the page generated by the plugin. An attacker can exploit this to execute script in the victim's browser.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue affects Xpro Elementor Addons: from n/a through 1.7.10.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS