# CVE-2026-83547: Xpro Addons stored XSS in widget settings

Source: https://junglewise.ai/threats/cve-2026-83547-xpro-addons-stored-xss-in-widget-settings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-83547 · Severity: medium · CVSS 6.8 · Published 2026-09-02

Xpro Addons is a popular WordPress plugin that extends the Elementor page builder with additional widgets. The plugin fails to properly escape widget configuration settings before displaying them in HTML, allowing authenticated users with Contributor role or higher to inject malicious JavaScript code. This stored attack affects anyone who views pages containing the compromised widgets, potentially leading to account hijacking or data theft.

Technologies: [Xpro Elementor Addons](https://junglewise.ai/threats/technologies/elementor-addons). Vendors: [Xpro](https://junglewise.ai/threats/vendors/xpro).

## Quick answers

**Is CVE-2026-83547 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-83547 being exploited in the wild.

**How severe is CVE-2026-83547?** Medium severity, with a CVSS score of 6.8, published 2 September 2026.

**Which products and versions are affected?** Xpro Elementor Addons 1.6.0 to 1.7.3.

**Is there a fix for CVE-2026-83547?** A patch was published on 2026-09-02: Fixed in version 1.7.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-83547 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-83547?** Check whether you run Xpro Elementor Addons at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in multiple widgets (Interactive Circle and Line Chart) within the Xpro Addons plugin. The root cause is inadequate output escaping of user-supplied widget settings before insertion into HTML attributes. Attack preconditions require an authenticated user with Contributor role or above; no network traversal is needed beyond normal WordPress access. An attacker can inject JavaScript payloads into widget configuration fields (e.g., item titles, dataset labels) that execute in the browsers of all users who view the affected page. The vulnerability was patched in version 1.7.4.

## Affected products

- Xpro Elementor Addons 1.6.0 to 1.7.3

## Timeline

- 2026-09-01: disclosed
- 2026-09-02: patched: Fixed in version 1.7.4

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://wpscan.com/vulnerability/a8298cc0-9e5b-41e2-ba44-b6f1bad30a67/](https://wpscan.com/vulnerability/a8298cc0-9e5b-41e2-ba44-b6f1bad30a67/)

## Related threats

- [Xpro Elementor Addons cross-site request forgery](https://junglewise.ai/threats/cve-2026-114177-cross-site-request-forgery-csrf-vulnerability-in-xpro-xpro)