What is the CVSS score of CVE-2025-15369?

CVE-2025-15369 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Xpro Addons CVE-2025-15369

EUVD-2025-209902 MEDIUM

Missing Authorization (CWE-862)

2026-05-20 Wordfence

GHSA-wfj4-gg7v-ph8q

WordPress Authentication Bypass Xpro Addons 140 Widgets For Elementor Wordpress Plugin Xpro

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 04:03 vuln.today

DescriptionCVE.org

The Xpro Addons - 140+ Widgets for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_content_editor function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to create published Xpro templates.

AnalysisAI

Unauthorized template creation in the Xpro Addons for Elementor WordPress plugin exposes sites to unauthenticated content injection via a missing capability check on the get_content_editor AJAX function. All plugin versions through 1.5.0 are affected, allowing any remote attacker without credentials to create and publish Xpro templates on targeted WordPress sites. No public exploit identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitability against default installations with no preconditions.

Technical ContextAI

CWE-862 (Missing Authorization) describes the root cause: the get_content_editor function in the Xpro Addons plugin executes privileged template-creation logic without invoking WordPress capability checks such as current_user_can(). In WordPress, AJAX handlers registered without nonce verification and capability gating are accessible to unauthenticated requests by default. The affected product is identified by CPE cpe:2.3:a:xpro:xpro_addons_-_140+_widgets_for_elementor:*:*:*:*:*:*:*:* - a widely-used Elementor addon bundle. The Elementor template system allows creation of reusable page layouts, meaning unauthorized published templates could be served to site visitors or used as a staging ground for further content manipulation.

RemediationAI

Apply the upstream fix committed to the Xpro Elementor Addons plugin SVN repository at revision 3508547, referenced at https://plugins.trac.wordpress.org/browser/xpro-elementor-addons/trunk?rev=3508547. A specific released patch version number is not independently confirmed in available data - verify via the WordPress plugin repository that a version newer than 1.5.0 is available and update immediately. As a compensating control while awaiting a confirmed patched release, site administrators can restrict access to WordPress AJAX endpoints (wp-admin/admin-ajax.php) for unauthenticated users via WAF rules or by using a security plugin such as Wordfence to block requests invoking get_content_editor without authentication. Note that blanket AJAX blocking may break other plugin functionality and should be tested in a staging environment first.