Executive brief
Xpro Addons is a popular WordPress plugin that extends the Elementor page builder with additional widgets. The plugin fails to properly validate or sanitize widget link settings, allowing contributors and higher-privileged users to inject and store malicious JavaScript code. When any visitor interacts with the affected widget, the stored JavaScript executes in their browser, potentially leading to account compromise, credential theft, or malicious redirects.
Technical details
This is a stored cross-site scripting (XSS) vulnerability (CWE-79) in the Interactive Circle Widget of Xpro Addons Elementor. The vulnerable component fails to sanitize or validate link settings before storing them in the database and later using them in JavaScript navigation calls. The attack vector is network-based and requires a user with contributor role or higher to inject the malicious payload. Once stored, the JavaScript executes in the browser of any user who views or interacts with the widget, without requiring additional user interaction beyond viewing the page. The vulnerability is fixed in version 1.7.9.
Affected products
- Xpro Addons — 140+ Widgets for Elementor before 1.7.9
Timeline
- 2026-09-14: disclosed
- 2026-09-16: patched: Fixed in version 1.7.9