Skip to content
Sign in
6.8 Medium

CVE-2026-84088 The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link…

Description

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.

Affected products and versions

Product Affected versions Fixed in
Xpro Addons — 140+ Widgets for Elementor 1.7 earliest → < 1.7.9 1.7.9

Other CVEs of Xpro Addons — 140+ Widgets for Elementor

The 2 CVEs of Xpro Addons — 140+ Widgets for Elementor →
CVE-2026-84146 The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or… 5.3 Medium
Track this CVE