Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Xpro Addons — 140+ Widgets for Elementor — Vulnerabilities & Security Advisories 16

All 16 CVE vulnerabilities found in Xpro Addons — 140+ Widgets for Elementor, with AI-generated Chinese analysis, references, and POCs.

This page documents security vulnerabilities affecting Xpro Addons — 140+ Widgets for Elementor, a WordPress plugin developed by Prof-themes, focusing on weaknesses such as cross-site scripting, insecure direct object references, and authorization bypasses. The collection aggregates all publicly disclosed security issues and vulnerability advisories associated with this specific plugin product, covering the entire timeline from its initial release through the most recent updates. This resource allows security researchers, developers, and site administrators to track vendor responses and patch release schedules, understand the technical details and attack vectors of specific weakness classes impacting Elementor-based sites, and look up a product's historical vulnerability data to assess long-term risk and stability. By consolidating these reports into a single view, the page provides a comprehensive overview of the plugin's security posture over time, enabling users to identify recurring issues, evaluate the frequency of critical fixes, and make informed decisions regarding plugin maintenance and updates. The information presented is derived from official vendor disclosures, third-party security databases, and community reports, ensuring that readers have access to accurate and verified data regarding known flaws. This aggregation serves as a reference point for auditing WordPress ecosystems, helping teams prioritize remediation efforts and maintain higher security standards across their digital infrastructure without relying on scattered or incomplete sources.

Vendor: xpro

CVE ID Title CVSS Severity Published
CVE-2026-84088 Xpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget - - 2026-09-16
CVE-2026-84146 Xpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick View - - 2026-09-04
CVE-2026-7105 Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function CWE-862 4.3 Medium 2026-08-05
CVE-2026-11614 Xpro Addons <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets CWE-79 6.4 Medium 2026-06-24
CVE-2025-15369 Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation CWE-862 5.3 Medium 2026-05-20
CVE-2025-13368 Xpro Addons — 140+ Widgets for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2026-04-04
CVE-2026-2949 Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget CWE-79 6.4 Medium 2026-04-04
CVE-2025-14149 Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link CWE-79 6.4 Medium 2026-02-27
CVE-2025-2108 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Site Title' widget CWE-79 6.4 Medium 2025-03-20
CVE-2024-13649 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2025-03-08
CVE-2024-12584 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.2 - Authenticated (Contributor+) Post Disclosure via Post Duplication CWE-200 4.3 Medium 2025-01-08
CVE-2024-10319 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template CWE-200 4.3 Medium 2024-11-05
CVE-2024-7791 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Grid Widget CWE-79 6.4 Medium 2024-08-27
CVE-2024-4471 140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection CWE-502 8.0 High 2024-05-23
CVE-2024-4440 140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets CWE-79 6.4 Medium 2024-05-14
CVE-2024-2250 130+ Widgets | Best Addons For Elementor – FREE <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2024-03-29

All 16 known CVE vulnerabilities affecting Xpro Addons — 140+ Widgets for Elementor with full Chinese analysis, references, and POCs where available.