Plugin icon

Xpro Addons — 140+ Widgets for Elementor

xpro-elementor-addons

Vulnerabilities:

20

Last Updated:

June 17, 2026

Active Installs:

30000

Published
Title
Fixed in
CVSS
Published
2026-06-23
Title
Xpro Addons < 1.7.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets
Fixed in
Fixed in 1.7.3
CVSS
5.5 (medium)
Published
2026-05-19
Title
Xpro Addons — 140+ Widgets for Elementor < 1.5.1 - Missing Authorization to Unauthenticated Xpro Template Creation
Fixed in
Fixed in 1.5.1
CVSS
5.3 (medium)
Published
2026-04-03
Title
Xpro Addons — 140+ Widgets for Elementor < 1.4.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.4.21
CVSS
5.5 (medium)
Published
2026-04-03
Title
Xpro Addons — 140+ Widgets for Elementor < 1.4.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget
Fixed in
Fixed in 1.4.25
CVSS
5.5 (medium)
Published
2026-02-26
Title
Xpro Addons — 140+ Widgets for Elementor < 1.4.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link
Fixed in
Fixed in 1.4.25
CVSS
6.4 (medium)
Published
2026-01-19
Title
Xpro Elementor Addons < 1.4.20 - Authenticated (Author+) Arbitrary File Upload
Fixed in
Fixed in 1.4.20
CVSS
8.8 (high)
Published
2025-12-06
Title
Xpro Elementor Addons < 1.4.20 - Contributor+ Stored XSS
Fixed in
Fixed in 1.4.20
CVSS
5.9 (medium)
Published
2025-08-27
Title
Xpro Elementor Addons < 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.4.18
CVSS
6.4 (medium)
Published
2025-04-04
Title
Xpro Elementor Addons < 1.4.11 - Contributor+ Stored XSS
Fixed in
Fixed in 1.4.11
CVSS
5.9 (medium)
Published
2025-03-19
Title
140+ Widgets | Xpro Addons For Elementor – FREE < 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Site Title' widget
Fixed in
Fixed in 1.4.8
CVSS
6.4 (medium)
Published
2025-03-07
Title
140+ Widgets | Xpro Addons For Elementor – FREE < 1.4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.4.6.8
CVSS
6.4 (medium)
Published
2025-01-07
Title
140+ Widgets | Xpro Addons For Elementor – FREE < 1.4.6.3 - Authenticated (Contributor+) Post Disclosure via Post Duplication
Fixed in
Fixed in 1.4.6.3
CVSS
4.3 (medium)
Published
2024-12-05
Title
Xpro Addons For Elementor < 1.4.6.6 - Contributor+ Stored XSS
Fixed in
Fixed in 1.4.6.6
CVSS
5.9 (medium)
Published
2024-11-04
Title
140+ Widgets | Xpro Addons For Elementor – FREE < 1.4.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
Fixed in
Fixed in 1.4.6.1
CVSS
4.3 (medium)
Published
2024-08-26
Title
140+ Widgets | Xpro Addons For Elementor – FREE < 1.4.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Grid Widget
Fixed in
Fixed in 1.4.4.4
CVSS
6.4 (medium)
Published
2024-08-07
Title
Xpro Elementor Addons < 1.4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.4.4.3
CVSS
6.4 (medium)
Published
2024-05-22
Title
140+ Widgets | Best Addons For Elementor – FREE < 1.4.3.2 - Authenticated (Contributor+) PHP Object Injection
Fixed in
Fixed in 1.4.3.2
CVSS
8 (high)
Published
2024-05-13
Title
140+ Widgets | Best Addons For Elementor – FREE < 1.4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Fixed in
Fixed in 1.4.3.1
CVSS
6.4 (medium)
Published
2024-05-07
Title
140+ Widgets | Best Addons For Elementor – FREE < 1.4.3.1 - Authenticated (Admin+) Cross Site Scripting
Fixed in
Fixed in 1.4.3.1
CVSS
4.4 (medium)
Published
2024-03-28
Title
130+ Widgets | Best Addons For Elementor – FREE < 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.4.3
CVSS
6.4 (medium)