What is the CVSS score of CVE-2026-11614?

CVE-2026-11614 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Xpro Elementor Addons CVE-2026-11614

EUVD-2026-38643 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-24 Wordfence

GHSA-j94v-j96m-m8j5

WordPress XSS Xpro Addons 140 Widgets For Elementor Wordpress Plugin Xpro

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Author-level WordPress account required (PR:L); stored payload fires in victim browsers without further attacker interaction (UI:N, S:C); no availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 03:44 vuln.today

CVE Published

Jun 24, 2026 - 02:29 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Xpro Addons - 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attributes' parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Xpro Addons plugin for WordPress (versions ≤1.7.2) allows authenticated attackers holding author-level or higher roles to permanently embed arbitrary JavaScript via the custom_attributes parameter across at least 12 distinct Elementor widget frontend templates. The injected payload executes in the browsers of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or administrative account takeover without further attacker interaction. No public exploit identified at time of analysis, though Wordfence has published source-code-level vulnerability locations across multiple widget layout files.

Technical ContextAI

Xpro Addons extends the Elementor page builder for WordPress, supplying over 140 custom widgets. The vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) exists in the PHP frontend layout templates of at least 12 widgets - including image-scroller, icon-box, button, hot-spot, promo-box, site-logo, site-title, animated-link, pricing, hero-slider, author-box, and info-list - where the custom_attributes widget parameter is rendered to the DOM without sufficient sanitization or output escaping. The affected CPE is cpe:2.3:a:xpro:xpro_addons_-_140+_widgets_for_elementor:*:*:*:*:*:*:*:*. Because Elementor stores widget configuration in the WordPress database, the malicious attribute value persists and is replayed to every subsequent visitor, classifying this as stored (persistent) XSS rather than reflected. The breadth of affected widget templates - spanning layout, navigation, content, and promotional widget categories - suggests the vulnerable rendering pattern is a shared code convention rather than an isolated bug.

RemediationAI

Update the Xpro Addons plugin to a version beyond 1.7.2; a specific patched release version is not confirmed in available data - verify the latest version via the WordPress Plugin Directory or the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0f78479f-8e28-4fa4-bf2b-eefedffa4d72. If an immediate update is not possible, restrict the WordPress Author role to fully trusted internal users only, since exploitation requires at minimum author-level access; this does not eliminate the vulnerability but removes untrusted actors from the injection path, with the trade-off of disrupting any open or community contributor workflows. As an additional compensating control, deploying a WAF rule that blocks common XSS payload patterns in POST requests targeting Elementor widget save endpoints can reduce exploitation probability, though misconfigured rules may interfere with legitimate custom HTML attribute values. Site administrators should also audit existing pages and posts built with affected widgets for unexpected or suspicious custom_attributes values as a post-incident check.