What’s Vulnerable › Products
Xpro Addons — 140+ Widgets for Elementor vulnerabilities
25 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.
Check whether your Xpro Addons — 140+ Widgets for Elementor version is affected
Latest Xpro Addons — 140+ Widgets for Elementor vulnerabilities
- CVE-2026-114177 — WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
- CVE-2026-7105 — Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function (CVSS 4.3)
- CVE-2026-11614 — Xpro Addons <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets (CVSS 6.4)
- CVE-2025-0898 — Xpro Elementor Addons - Pro <= 1.4.7 - Authenticated (Contributor+) Arbitrary File Read via Draw SVG (CVSS 6.5)
- CVE-2025-15369 — Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation (CVSS 5.3)
- CVE-2026-45214 — WordPress Xpro Elementor Addons plugin <= 1.5.1 - SQL Injection vulnerability (CVSS 8.5)
- CVE-2025-13368 — Xpro Addons — 140+ Widgets for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- CVE-2026-2949 — Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget (CVSS 6.4)
- CVE-2025-14149 — Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link (CVSS 6.4)
- CVE-2025-69312 — WordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Arbitrary File Upload vulnerability (CVSS 9.1)
- CVE-2025-63044 — WordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2025-58195 — WordPress Xpro Elementor Addons Plugin <= 1.4.17 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- CVE-2024-13808 — Xpro Elementor Addons - Pro <= 1.4.9 - Authenticated (Contributor+) Remote Code Execution (CVSS 8.8)
- CVE-2025-32163 — WordPress Xpro Elementor Addons plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2025-2108 — 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Site Title' widget (CVSS 6.4)
- CVE-2024-13649 — 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
- CVE-2024-12584 — 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.2 - Authenticated (Contributor+) Post Disclosure via Post Duplication (CVSS 6.5)
- CVE-2024-54253 — WordPress Xpro Addons For Elementor plugin <= 1.4.6.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
- CVE-2024-10319 — 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template (CVSS 4.3)
- CVE-2024-7791 — 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Grid Widget (CVSS 5.4)
- CVE-2024-43150 — WordPress Xpro Elementor Addons plugin <= 1.4.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
- CVE-2024-4471 — 140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.0)
- CVE-2024-4440 — 140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4)
- CVE-2024-34570 — WordPress Xpro Elementor Addons plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 4.8)
- CVE-2024-2250 — 130+ Widgets | Best Addons For Elementor – FREE <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)