EUVD-2026-80190
GHSA-3g4x-jr35-cm83
Lifecycle Timeline
2DescriptionCVE.org
The Xpro Addons - 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.
Analysis
The Xpro Addons - 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated information disclosure in the Xpro Addons - 140+ Widgets for Elementor WordPress plugin (versions before
Stored Cross-Site Scripting in the Xpro Addons plugin for WordPress (versions ≤1.7.2) allows authenticated attackers hol
Stored Cross-Site Scripting (XSS) in Xpro Addons - 140+ Widgets for Elementor plugin for WordPress up to version 1.4.24
Stored Cross-Site Scripting in Xpro Addons - 140+ Widgets for Elementor plugin up to version 1.4.20 allows authenticated
Unauthorized template creation in the Xpro Addons for Elementor WordPress plugin exposes sites to unauthenticated conten
Unauthorized post creation in Xpro Addons - 140+ Widgets for Elementor (WordPress) affects all versions through 1.5.1, a
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today