Xpro vulnerabilities

CVEs per yearBy the year they were published

1. 20248
2. 20259
3. 202610

Newest CVEs

• CVE-2026-114177

  WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability

  Xpro · Xpro Elementor Addons

  High8.8
• CVE-2026-7105

  Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function

  xpro · Xpro Addons — 140+ Widgets for Elementor

  Medium4.3
• CVE-2026-11614

  Xpro Addons <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets

  xpro · Xpro Addons — 140+ Widgets for Elementor

  Medium6.4
• CVE-2025-15369

  Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation

  xpro · Xpro Addons — 140+ Widgets for Elementor

  Medium5.3
• CVE-2026-45214

  WordPress Xpro Elementor Addons plugin <= 1.5.1 - SQL Injection vulnerability

  Xpro · Xpro Elementor Addons

  High8.5
• CVE-2025-13368

  Xpro Addons — 140+ Widgets for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting

  xpro · Xpro Addons — 140+ Widgets for Elementor

  Medium6.4
• CVE-2026-2949

  Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget

  xpro · Xpro Addons — 140+ Widgets for Elementor

  Medium6.4
• CVE-2026-32395

  WordPress Xpro Addons For Beaver Builder – Lite plugin <= 1.5.6 - Broken Access Control vulnerability

  Xpro · Xpro Addons For Beaver Builder – Lite

  Medium5.3
• CVE-2025-14149

  Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link

  xpro · Xpro Addons — 140+ Widgets for Elementor

  Medium6.4
• CVE-2025-69312

  WordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Arbitrary File Upload vulnerability

  Xpro · Xpro Elementor Addons

  Critical9.1