What’s Vulnerable › Vulnerabilities
CVE-2026-84146: Xpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick View
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-04 · updated 2026-09-08
- Weakness: CWE-200
Description
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).
Affected products
- Xpro Addons — 140+ Widgets for Elementor: before 1.7.8 — fixed in 1.7.8
How to fix
Upgrade to a fixed version: Xpro Addons — 140+ Widgets for Elementor 1.7.8. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-84146 or the next vulnerability affects your stack