EUVD-2026-70047
GHSA-7rxv-rgcp-8v64
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor role is PR:L not PR:H; stored XSS changes scope (S:C); direct impact is session/data partial, not C:H/I:H/A:H.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
AnalysisAI
Stored Cross-Site Scripting in Xpro Addons for WordPress (before 1.7.4) allows any user holding the Contributor role or higher to inject malicious JavaScript through insufficiently escaped widget settings, which are then rendered unsanitized within HTML attributes on the front end. When a privileged user such as an administrator views a page containing the compromised widget, the attacker's payload executes in their browser session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a WordPress user account with at minimum the Contributor role. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The submitted CVSS vector (PR:H/S:U/C:H/I:H/A:H) contains several metric disagreements with the described vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Xpro Addons plugin to version 1.7.4 or later via the WordPress admin dashboard (Plugins → Updates) or by downloading directly from the WordPress plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today