# CVE-2026-45214: Xpro Elementor Addons SQL injection in xpro-elementor-addons

Source: https://junglewise.ai/threats/cve-2026-45214-xpro-elementor-addons-sql-injection-in-xpro-elementor-addons  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2026-45214 · Severity: high · CVSS 8.5 · Published 2026-05-12

Xpro Elementor Addons is a WordPress plugin used to add custom design elements and widgets to websites. A security flaw in this plugin allows an attacker with basic user permissions to perform a 'blind' SQL injection attack. This could allow an unauthorized person to extract sensitive information from the website's database, potentially compromising user data or site configuration.

Technologies: [Xpro Elementor Addons](https://junglewise.ai/threats/technologies/elementor-addons). Vendors: [Xpro](https://junglewise.ai/threats/vendors/xpro).

## Quick answers

**Is CVE-2026-45214 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45214 being exploited in the wild.

**How severe is CVE-2026-45214?** High severity, with a CVSS score of 8.5, published 12 May 2026.

**Which products and versions are affected?** Xpro Elementor Addons <= 1.5.1.

**Is there a fix for CVE-2026-45214?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45214 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45214?** Check whether you run Xpro Elementor Addons at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Blind SQL Injection vulnerability exists in the Xpro Elementor Addons plugin for WordPress due to improper neutralization of special elements used in an SQL command. The flaw is present in versions up to and including 1.5.1. An attacker with 'Contributor' level privileges or higher can exploit this vulnerability via network requests to interact directly with the database. Successful exploitation allows the attacker to extract sensitive information through inference (blind injection). The issue is addressed in version 1.5.2.

## Affected products

- Xpro Xpro Elementor Addons <= 1.5.1

## Timeline

- 2026-02-28: other: Reported by researcher daroo
- 2026-03-30: advisory: Patchstack advisory published
- 2026-05-12: disclosed: CVE published to NVD

## References

- [https://patchstack.com/database/Wordpress/Plugin/xpro-elementor-addons/vulnerability/wordpress-xpro-elementor-addons-plugin-1-5-1-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/xpro-elementor-addons/vulnerability/wordpress-xpro-elementor-addons-plugin-1-5-1-sql-injection-vulnerability?_s_id=cve)