CVE-2026-83547

Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Affected

Xpro Addons

CVSS v3.1 WPSCAN

6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS

0.24% chance of exploitation in the next 30 days, 14th percentile

Published

2026-09-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/a8298cc0-9e5b-41e2-ba44-b6f1bad30a67/

References

• CVE Record
• NVD entry