Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-17
Xpro Addons - Security Vulnerability (CVE-2026-84088)
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.
PLUGIN
Xpro Addons
CVE-2026-84088
Risk Score
Threat Entry
Updated 2026-09-08
Xpro Addons - Security Vulnerability (CVE-2026-84146)
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).
PLUGIN
Xpro Addons
CVE-2026-84146
Risk Score
Threat Entry
Updated 2026-09-03
Xpro Addons - Cross-Site Scripting (XSS) (CVE-2026-83547)
The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Xpro Addons
CVE-2026-83547
Risk Score
Threat Entry
Updated 2026-08-12
Xpro Addons - Broken Access Control (CVE-2026-7105)
The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the `get_menu_content_editor()` function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary published posts of the `xpro_content` custom post type with attacker-controlled titles. The created posts are publicly queryable on the front-end, enabling content injection, SEO spam, and database pollution.
PLUGIN
Xpro Addons
CVE-2026-7105
Risk Score
Threat Entry
Updated 2026-06-25
Xpro Addons - Cross-Site Scripting (XSS) (CVE-2026-11614)
The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attributes' parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Xpro Addons
CVE-2026-11614
Risk Score
Threat Entry
Updated 2026-07-24
Xpro Addons - Broken Access Control (CVE-2025-15369)
The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_content_editor function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to create published Xpro templates.
PLUGIN
Xpro Addons
CVE-2025-15369
Risk Score
Threat Entry
Updated 2026-07-24
Xpro Addons - Cross-Site Scripting (XSS) (CVE-2025-13368)
The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Widget's 'onClick Event' setting in all versions up to, and including, 1.4.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Xpro Addons
CVE-2025-13368
Risk Score
Threat Entry
Updated 2026-07-24
Xpro Addons - Cross-Site Scripting (XSS) (CVE-2026-2949)
The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Box widget in versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Xpro Addons
CVE-2026-2949
Risk Score
Threat Entry
Updated 2026-06-17
Xpro Addons - Cross-Site Scripting (XSS) (CVE-2025-14149)
The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Scroller widget box link attribute in all versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Xpro Addons
CVE-2025-14149
Risk Score