WordPress plugin
Xpro Addons — 150+ Widgets for Elementor security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 26 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High2
- Medium24
- Low0
All Xpro Addons — 150+ Widgets for Elementor vulnerabilities
- Medium4.3Cross-Site Request Forgery
≤1.7.10Update to 1.7.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.7.8Update to 1.7.9
- Medium5.3Unauthenticated Information Exposure
<1.7.8Update to 1.7.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.7.3Update to 1.7.4
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function
≤1.5.1Update to 1.5.2
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets
≤1.7.2Update to 1.7.3
- Medium5.3Missing Authorization to Unauthenticated Xpro Template Creation
≤1.5.0Update to 1.5.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.4.20Update to 1.4.21
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget
≤1.4.24Update to 1.4.25
- Medium6.5Authenticated (Contributor+) SQL Injection
≤1.5.1Update to 1.5.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link
≤1.4.24Update to 1.4.25
- High8.8Authenticated (Author+) Arbitrary File Upload
≤1.4.19.1Update to 1.4.20
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.4.19.1Update to 1.4.20
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.4.17Update to 1.4.18
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.4.10Update to 1.4.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'Site Title' widget
≤1.4.7.1Update to 1.4.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.4.6.7Update to 1.4.6.8
- Medium4.3Authenticated (Contributor+) Post Disclosure via Post Duplication
≤1.4.6.2Update to 1.4.6.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.4.6.5Update to 1.4.6.6
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
≤1.4.6Update to 1.4.6.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Grid Widget
≤1.4.4.3Update to 1.4.4.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.4.4.2Update to 1.4.4.3
- High8.0Authenticated (Contributor+) PHP Object Injection
≤1.4.3.1Update to 1.4.3.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
≤1.4.3Update to 1.4.3.1
- Medium4.4Authenticated (Admin+) Cross Site Scripting
≤1.4.3Update to 1.4.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.4.2Update to 1.4.3
Xpro Addons — 150+ Widgets for Elementor: common questions
Does Xpro Addons — 150+ Widgets for Elementor have known vulnerabilities?
Yes. VulnCrest Radar lists 26 known vulnerabilities in Xpro Addons — 150+ Widgets for Elementor: 2 high, 24 medium. None are known to affect version null.
How do I check which version of Xpro Addons — 150+ Widgets for Elementor I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Xpro Addons — 150+ Widgets for Elementor vulnerability?
CVE-2026-114177, published Oct 22, 2026: Xpro Addons — 150+ Widgets for Elementor <= 1.7.10 - Cross-Site Request Forgery. Severity: Medium (CVSS 4.3).
Is any Xpro Addons — 150+ Widgets for Elementor vulnerability listed in CISA KEV?
No. None of the known Xpro Addons — 150+ Widgets for Elementor vulnerabilities is currently listed in the CISA KEV catalog.