EUVD-2026-18969Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Xpro Addons - 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Box widget in versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting (XSS) in Xpro Addons - 140+ Widgets for Elementor plugin for WordPress up to version 1.4.24 allows authenticated contributors and above to inject malicious scripts via the Icon Box widget that execute for all users viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping, making it a direct code injection risk in a widely-used page builder extension. CVSS 6.4 reflects moderate severity with limited direct impact (confidentiality and integrity) but cross-site scope; no public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The vulnerability is a Stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in a WordPress plugin that extends the Elementor page builder with additional widgets. The Icon Box widget fails to properly sanitize user-supplied input during widget configuration and does not apply adequate escaping when rendering the widget output to the frontend. Because this is a Stored XSS vulnerability in a page builder context, the malicious payload is persisted in the WordPress database (in post/page meta or settings) and executes in the context of every visitor's browser session, not just the attacker's session. The attack vector is network-based and requires only low privileges (contributor role or above in WordPress), with no user interaction required beyond the attacker's initial widget configuration. This is a common pattern in page builder plugins where widgets accept rich content or custom HTML without proper sanitization.
RemediationAI
Update the Xpro Addons - 140+ Widgets for Elementor plugin to a patched version released after 1.4.24. A fix is confirmed available in the WordPress plugins repository changeset 3470049 (https://plugins.trac.wordpress.org/changeset/3470049/xpro-elementor-addons). WordPress administrators should navigate to Plugins > Installed Plugins, locate Xpro Addons, and apply the available update immediately. For installations unable to update immediately, restrict contributor-level access to trusted authors only and audit existing Icon Box widgets for suspicious content. After patching, review all pages and posts containing Icon Box widgets for any injected malicious scripts and remove them if detected.
Unauthenticated information disclosure in the Xpro Addons - 140+ Widgets for Elementor WordPress plugin (versions before
Stored Cross-Site Scripting in the Xpro Addons plugin for WordPress (versions ≤1.7.2) allows authenticated attackers hol
Stored Cross-Site Scripting in Xpro Addons - 140+ Widgets for Elementor plugin up to version 1.4.20 allows authenticated
Unauthorized template creation in the Xpro Addons for Elementor WordPress plugin exposes sites to unauthenticated conten
Unauthorized post creation in Xpro Addons - 140+ Widgets for Elementor (WordPress) affects all versions through 1.5.1, a
The Xpro Addons - 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link s
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today