CVE-2026-84088
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call. This allows users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.
Risk Assessment
The organization is exposed to execution of malicious JavaScript in visitors' browsers, which could lead to data theft, session hijacking, or malware distribution.
Recommendation
It is recommended to update the Xpro Addons plugin to version 1.7.9 or later, which adds validation and sanitization of widget link settings.
Other vulnerabilities in Xpro Addons
See all- CVE-2026-84146Medium
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before version 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).
- CVE-2026-7105Medium
The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the `get_menu_content_editor()` function in all versions up to and including 1.5.1. This allows authenticated attackers with Subscriber-level access and above to create arbitrary published posts of the `xpro_content` custom post type with attacker-controlled titles.
- CVE-2025-15369Medium
Missing capability check in the get_content_editor function of the Xpro Addons plugin for WordPress allows unauthenticated attackers to create published Xpro templates.
- CVE-2025-13368Medium
Stored Cross-Site Scripting (XSS) vulnerability in WordPress Xpro Addons plugin up to version 1.4.20. Through the 'onClick Event' setting in the Pricing Widget, attackers with contributor-level access or higher can inject arbitrary scripts that execute when a page is visited.
- CVE-2026-2949Medium
Stored XSS vulnerability in the Xpro Addons plugin for WordPress (versions up to 1.4.24). Insufficient input sanitization and output escaping in the Icon Box widget allow authenticated attackers (contributor level and above) to inject malicious JavaScript.
Original NVD description (English source)
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS