WordPress security by component

Xpro Elementor Addons

Plugin description

Xpro Elementor Addons adds Elementor widgets, templates, and design extensions for building WordPress pages and interface components.

Xpro Elementor Addons (xpro-elementor-addons) is a WordPress plugin with 14 published CVE records in this archive. The latest tracked vulnerability was published Aug 05, 2026; the highest published CVSS base score is 9.1.

Plugin slug: xpro-elementor-addons

Latest vulnerability

CVE-2026-7105: Xpro Addons subscriber access creates published xpro_content posts

Xpro Addons through 1.5.1 omits a capability check from get_menu_content_editor(). A Subscriber can supply an attacker-controlled title and create a published xpro_content custom post that is publicly queryable on the frontend, enabling unauthorized content injection, SEO spam and database pollution. This 4.3-scored record received deeper review because it gives a low-privilege account a public-content creation primitive. The CNA does not disclose the AJAX action, title parameter or post-creation function.

PublishedAug 05, 2026

Known safe version> 1.5.1

Published vulnerabilities for xpro-elementor-addons
		Safe version
Aug 05, 2026	CVE-2026-7105 Xpro Addons subscriber access creates published xpro_content posts Xpro Addons through 1.5.1 omits a capability check from get_menu_content_editor(). A Subscriber can supply an attacker-controlled title and create a published xpro_content custom post that is publicly queryable on the frontend, enabling unauthorized content injection, SEO spam and database pollution. This 4.3-scored record received deeper review because it gives a low-privilege account a public-content creation primitive. The CNA does not disclose the AJAX action, title parameter or post-creation function.	> 1.5.1	CVE4.3 NVDPending
Jun 24, 2026	CVE-2026-11614 Xpro Addons — 140+ Widgets for Elementor: Cross-site scripting Xpro Addons — 140+ Widgets for Elementor is affected by cross-site scripting. Exploitation requires an authenticated author account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 1.7.2.	See mitigation notes	CVE6.4 NVDPending
May 20, 2026	CVE-2025-15369 Xpro Addons — 140+ Widgets for Elementor: A security weakness Xpro Addons — 140+ Widgets for Elementor is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.5.0. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE5.3 NVDPending
May 12, 2026	CVE-2026-45214 Xpro Elementor Addons: SQL injection Xpro Elementor Addons is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 1.5.1. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	1.5.2	CVE8.5 NVDPending
Jan 22, 2026	CVE-2025-69312 Xpro Elementor Addons: Dangerous file upload Xpro Elementor Addons is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE9.1 NVDPending
Dec 09, 2025	CVE-2025-63044 Xpro Elementor Addons: Cross-site scripting Xpro Elementor Addons is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE6.5 NVDPending
Aug 27, 2025	CVE-2025-58195 Xpro Elementor Addons: Cross-site scripting Xpro Elementor Addons is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE6.5 NVDPending
Apr 04, 2025	CVE-2025-32163 Xpro Elementor Addons: Cross-site scripting Xpro Elementor Addons is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE6.5 NVDPending
Mar 20, 2025	CVE-2025-2108 140+ Widgets \| Xpro Addons For Elementor – FREE: Cross-site scripting 140+ Widgets \| Xpro Addons For Elementor – FREE is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE6.4 NVDPending
Aug 27, 2024	CVE-2024-7791 140+ Widgets \| Xpro Addons For Elementor – FREE: Cross-site scripting 140+ Widgets \| Xpro Addons For Elementor – FREE is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE6.4 NVD5.4
Aug 12, 2024	CVE-2024-43150 Xpro Elementor Addons: Cross-site scripting Xpro Elementor Addons is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE6.5 NVD5.4
May 23, 2024	CVE-2024-4471 Xpro Elementor Addons: Code execution Xpro Elementor Addons is affected by code execution. Exploitation requires an authenticated contributor account. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE8.0 NVDPending
May 14, 2024	CVE-2024-4440 140+ Widgets \| Best Addons For Elementor – FREE: Cross-site scripting 140+ Widgets \| Best Addons For Elementor – FREE is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE6.4 NVDPending
May 08, 2024	CVE-2024-34570 Xpro Elementor Addons: Cross-site scripting Xpro Elementor Addons is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE5.9 NVD4.8

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers