CVE-2026-7105
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the `get_menu_content_editor()` function in all versions up to and including 1.5.1. This allows authenticated attackers with Subscriber-level access and above to create arbitrary published posts of the `xpro_content` custom post type with attacker-controlled titles.
Risk Assessment
Attackers can inject content, potentially leading to SEO spam, database pollution, and loss of user trust.
Recommendation
Update the Xpro Addons plugin to the latest version if available. Restrict access to editing functions and monitor for unusual posts.
Other vulnerabilities in Xpro Addons
See all- CVE-2025-15369Medium
Missing capability check in the get_content_editor function of the Xpro Addons plugin for WordPress allows unauthenticated attackers to create published Xpro templates.
- CVE-2025-13368Medium
Stored Cross-Site Scripting (XSS) vulnerability in WordPress Xpro Addons plugin up to version 1.4.20. Through the 'onClick Event' setting in the Pricing Widget, attackers with contributor-level access or higher can inject arbitrary scripts that execute when a page is visited.
- CVE-2026-2949Medium
Stored XSS vulnerability in the Xpro Addons plugin for WordPress (versions up to 1.4.24). Insufficient input sanitization and output escaping in the Icon Box widget allow authenticated attackers (contributor level and above) to inject malicious JavaScript.
Original NVD description (English source)
The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the `get_menu_content_editor()` function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary published posts of the `xpro_content` custom post type with attacker-controlled titles. The created posts are publicly queryable on the front-end, enabling content injection, SEO spam, and database pollution.