Skip to content
Sign in
5.3 Medium

CVE-2026-84146 The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or…

Description

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).

Affected products and versions

Product Affected versions Fixed in
Xpro Addons — 140+ Widgets for Elementor 1.7 earliest → < 1.7.8 1.7.8

Other CVEs of Xpro Addons — 140+ Widgets for Elementor

The 2 CVEs of Xpro Addons — 140+ Widgets for Elementor →
CVE-2026-84088 The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link… 6.8 Medium
Track this CVE