CVE-2026-114177: WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability

Q: What must an attacker do to exploit this issue?

An attacker would need to cause a victim to interact with a crafted request, as indicated by the required user interaction (UI:R). No attacker authentication is required (PR:N), and the attack can be delivered over the network (AV:N).

Q: Which plugin versions are affected?

Xpro Elementor Addons versions through 1.7.10 are affected. The provided data does not identify a fixed version.

Q: How serious could a successful attack be?

The vulnerability is rated high with a CVSS score of 8.8. A successful exploit may affect confidentiality, integrity, and availability, each rated High in the supplied vector.

Published Oct 22, 2026

Updated

Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue affects Xpro Elementor Addons: from n/a through 1.7.10.

Affected Software

1 affected component

Xpro Xpro Elementor Addons<=1.7.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/xpro-elementor-addons to a version that resolves this vulnerability.
Fixed in 1.7.11

Event History

Oct 22, 2026

CVE Published

via MITRE·06:50 AM

Data Sourced

via MITRE·06:50 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

An attacker would need to cause a victim to interact with a crafted request, as indicated by the required user interaction (UI:R). No attacker authentication is required (PR:N), and the attack can be delivered over the network (AV:N).

Which plugin versions are affected?