WordPress Plugin Vulnerabilities

Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets

Description

The plugin does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

Affects Plugins

Plugin icon
xpro-elementor-addons
Fixed in 1.7.4

References

CVE
CVE-2026-83547

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Dmitrii Ignatyev
Submitter
Dmitrii Ignatyev
Submitter website
https://research.cleantalk.org/
Verified
Yes
WPVDB ID
a8298cc0-9e5b-41e2-ba44-b6f1bad30a67

Timeline

Publicly Published
2026-09-01 (about 1 day ago)
Added
2026-09-01 (about 1 day ago)
Last Updated
2026-09-01 (about 1 day ago)

Other

Published
Title
Published
2023-04-18
Title
YellowPencil Visual CSS Style Editor < 7.5.9 - Admin+ Stored XSS
Published
2021-11-25
Title
Awesome Support < 6.0.7 - Reflected Cross-Site Scripting
Published
2025-12-31
Title
Shuttle <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-01-16
Title
Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio < 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Published
2025-11-20
Title
Pollcaster Shortcode Plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode