Xpro Elementor Addons CVE-2026-114177

Exploitation requires a WordPress site running Xpro Elementor Addons version 1.7.10 or earlier, AND a currently authenticated, privileged user (typically an administrator) who is tricked into interacting with attacker-controlled content (visiting a malicious page or clicking a crafted link) while their session is active (UI:R). The vulnerability stems from missing or improper anti-CSRF nonce validation on a plugin action. Limiting factors: the attacker cannot act without a logged-in victim performing the interaction, exploitation yields only the privileges of that victim, and no privileged standing is granted to the attacker directly (PR:N applies to the attacker, not the victim). The specific vulnerable feature/endpoint is not named in the description, so defenders should treat any sensitive plugin-controlled action as potentially reachable.

This is a CWE-352 Cross-Site Request Forgery flaw in the Xpro Elementor Addons WordPress plugin (versions through 1.7.10). The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity exploitation that requires no attacker privileges (PR:N) but DOES require victim interaction (UI:R) - characteristic of CSRF, where a logged-in user (typically an administrator) must be lured into triggering a forged request. The high C/I/A impacts (8.8) are consistent with Patchstack's scoring convention for CSRF that can reach sensitive admin actions, but note that real impact is gated entirely on tricking an authenticated, privileged user into interaction, which materially lowers practical risk versus a true unauthenticated RCE of the same score. Exploitation status: no public exploit identified at time of analysis - there is no EPSS score, no CISA KEV listing, and no POC indicator in the provided data. The only source is the Patchstack/NVD reference. CONFLICTING/MISSING SIGNALS: the high 8.8 score contrasts sharply with the absence of any exploitation evidence (no KEV, no EPSS, no POC), suggesting this is a high-CVSS-but-currently-low-real-world-risk issue rather than an active threat. Overall priority is moderate: patch in routine cycles, prioritizing sites with high-privilege users exposed to untrusted web browsing.

An attacker crafts a malicious web page or email containing a forged request targeting the plugin's vulnerable action and lures a logged-in WordPress administrator into visiting it. Because the request lacks proper anti-CSRF nonce validation, the victim's browser submits it with valid session cookies, causing an unauthorized state change under the admin's privileges. No public POC is identified in the provided data, and exploitation depends on the victim being authenticated and clicking the attacker-controlled link (UI:R).