EUVD-2026-70913
GHSA-pc32-gr34-xm6c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible, no auth required, low complexity; only limited WooCommerce product metadata disclosed with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Xpro Addons - 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).
AnalysisAI
Unauthenticated information disclosure in the Xpro Addons - 140+ Widgets for Elementor WordPress plugin (versions before 1.7.8) exposes non-public WooCommerce product data - including titles, prices, SKUs, descriptions, and stock levels - to any visitor without authentication. The plugin renders product summaries via a widget endpoint without performing any post-status or capability check, meaning products in draft, pending, private, or scheduled states are fully retrievable by arbitrary external requesters. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target WordPress site has the Xpro Addons plugin installed and active at a version below 1.7.8; (2) WooCommerce is also active on the same WordPress installation; and (3) at least one WooCommerce product exists in a non-public post status (draft, pending, private, or scheduled). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately reflects the constrained impact: no authentication is required and no user interaction is needed, but confidentiality impact is low because only draft or private WooCommerce product metadata is disclosed - not credentials, session tokens, or configuration secrets. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Xpro Addons - 140+ Widgets for Elementor plugin to version 1.7.8 or later, which introduces the missing capability and post-status checks before rendering product summaries. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored Cross-Site Scripting in the Xpro Addons plugin for WordPress (versions ≤1.7.2) allows authenticated attackers hol
Stored Cross-Site Scripting (XSS) in Xpro Addons - 140+ Widgets for Elementor plugin for WordPress up to version 1.4.24
Stored Cross-Site Scripting in Xpro Addons - 140+ Widgets for Elementor plugin up to version 1.4.20 allows authenticated
Unauthorized template creation in the Xpro Addons for Elementor WordPress plugin exposes sites to unauthenticated conten
Unauthorized post creation in Xpro Addons - 140+ Widgets for Elementor (WordPress) affects all versions through 1.5.1, a
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today