CVE-2026-11614: Xpro Addons <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets
The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customattributes' parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Xpro Addons — 140+ Widgets for Elementorto a version that resolves this vulnerability.Fixed in 1.7.2 - Compensating control
Until patched, restrict access to WordPress author-level (and above) accounts and ensure only trusted users have Author+ privileges to reduce the risk of stored XSS injection via the 'custom_attributes' parameter.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11614?
The severity of CVE-2026-11614 is classified as medium with a score of 6.4.
How do I fix CVE-2026-11614?
To fix CVE-2026-11614, update the Xpro Addons plugin to version 1.7.3 or later.
What impact does CVE-2026-11614 have on my website?
CVE-2026-11614 allows for authenticated stored cross-site scripting attacks, which could compromise the security of your website.
Who is affected by CVE-2026-11614?
CVE-2026-11614 affects users of Xpro Addons for Elementor plugin versions up to and including 1.7.2.
What is the attack vector for CVE-2026-11614?
The attack vector for CVE-2026-11614 involves using the 'custom_attributes' parameter in multiple widgets without proper input sanitization.