# CVE-2025-0898: Xpro Elementor Addons Pro arbitrary file reading in Draw SVG widget

Source: https://junglewise.ai/threats/cve-2025-0898-xpro-elementor-addons-pro-arbitrary-file-reading-in-draw-svg  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2025-0898 · Severity: medium · CVSS 6.5 · Published 2026-05-27

The Xpro Elementor Addons - Pro plugin for WordPress, which provides enhanced design widgets for website building, contains a security flaw in its Draw SVG widget. This vulnerability allows users with basic contributor-level access to read sensitive files stored on the web server. An attacker could use this to gain access to configuration files, passwords, or other private data, potentially leading to a full site takeover.

Vendors: [Xpro](https://junglewise.ai/threats/vendors/xpro).

## Quick answers

**Is CVE-2025-0898 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-0898 being exploited in the wild.

**How severe is CVE-2025-0898?** Medium severity, with a CVSS score of 6.5, published 27 May 2026.

**Which products and versions are affected?** Xpro Elementor Addons - Pro Up to, and including, 1.4.7.

**Is there a fix for CVE-2025-0898?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-0898 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-0898?** Check whether you run Xpro Elementor Addons - Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to arbitrary file reading due to insufficient input validation and path sanitization within the Draw SVG widget. Authenticated attackers with Contributor-level permissions or higher can exploit this flaw to retrieve the contents of arbitrary files on the server. The vulnerability exists in all versions up to and including 1.4.7. By manipulating the file path parameters associated with the SVG rendering component, an attacker can bypass intended directory restrictions to access sensitive system or configuration files (such as wp-config.php).

## Affected products

- Xpro Elementor Addons Xpro Elementor Addons - Pro Up to, and including, 1.4.7

## Timeline

- 2026-05-27: advisory: NVD publication date

## References

- [https://elementor.wpxpro.com/](https://elementor.wpxpro.com/)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/1f87298b-8dae-4201-8f3b-477eaab3663d?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/1f87298b-8dae-4201-8f3b-477eaab3663d?source=cve)