Xpro Addons — 150+ Widgets for Elementor

xpro-elementor-addons · plugin

Known security vulnerabilities for Xpro Addons — 150+ Widgets for Elementor. Find out in seconds which version runs on your site with WP Lens.

22 known vulnerabilities

1 critical · 1 exploitable without logging in · latest Aug 5, 2026

Listed on wordpress.org · latest 1.7.10 · last updated Oct 2, 2026 · 40K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

CVE-2025-69312high privilege≤ 1.4.19.1
WordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Arbitrary File Upload vulnerability
Critical 9.1
CVE-2026-45214login required≤ 1.5.1
WordPress Xpro Elementor Addons plugin <= 1.5.1 - SQL Injection vulnerability
High 8.5
CVE-2024-4471contributor+≤ 1.4.3.1
140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection
High 8.0
CVE-2025-63044login required≤ 1.4.19.1
WordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Cross Site Scripting (XSS) vulnerability
Medium 6.5
CVE-2025-58195login required≤ 1.4.17
WordPress Xpro Elementor Addons Plugin <= 1.4.17 - Cross Site Scripting (XSS) Vulnerability
Medium 6.5
CVE-2025-32163login required≤ 1.4.10
WordPress Xpro Elementor Addons plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability
Medium 6.5
CVE-2024-12584contributor+≤ 1.4.6.2
140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.2 - Authenticated (Contributor+) Post Disclosure via Post Duplication
Medium 6.5
CVE-2026-11614author+≤ 1.7.2
Xpro Addons <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets
Medium 6.4
CVE-2025-13368contributor+≤ 1.4.20
Xpro Addons — 140+ Widgets for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium 6.4
CVE-2026-2949contributor+≤ 1.4.24
Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget
Medium 6.4
CVE-2025-14149contributor+≤ 1.4.24
Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link
Medium 6.4
CVE-2025-2108contributor+≤ 1.4.7.1
140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Site Title' widget
Medium 6.4
CVE-2024-4440contributor+≤ 1.4.3
140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Medium 6.4
CVE-2024-2250contributor+≤ 1.4.2
130+ Widgets | Best Addons For Elementor – FREE <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium 6.4
CVE-2024-54253login required≤ 1.4.6.5
WordPress Xpro Addons For Elementor plugin <= 1.4.6.5 - Cross Site Scripting (XSS) vulnerability
Medium 5.4
CVE-2024-43150login required≤ 1.4.4.2
WordPress Xpro Elementor Addons plugin <= 1.4.4.2 - Cross Site Scripting (XSS) vulnerability
Medium 5.4
CVE-2024-13649contributor+≤ 1.4.6.7
140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium 5.4
CVE-2024-7791contributor+≤ 1.4.4.3
140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Grid Widget
Medium 5.4
CVE-2025-15369unauthenticated≤ 1.5.0
Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation
Medium 5.3
CVE-2024-34570high privilege≤ 1.4.3
WordPress Xpro Elementor Addons plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability
Medium 4.8
CVE-2026-7105subscriber+≤ 1.5.1
Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function
Medium 4.3
CVE-2024-10319contributor+≤ 1.4.6
140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory