CVE-2026-83547: Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets
Published Sep 2, 2026
·Updated
The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Software
2 affected components
Xpro Addons WordPress plugin<=1.7.4
WordPress plugin>=1.6.0<=1.7.3
Event History
Sep 2, 2026
CVE Published
via MITRE·02:16 PM
Data Sourced
via MITRE·02:16 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which sites are exposed to this issue?
WordPress sites using Xpro Addons versions before 1.7.4 are affected. Exploitation requires an account with the Contributor role or higher, so unauthenticated visitors cannot directly exploit it.
2
What access and interaction does an attacker need?
An attacker needs Contributor-level or greater WordPress access to save malicious widget settings. A user must then view content that renders the stored payload for the cross-site scripting to execute.
3
How can this be remediated?
Update Xpro Addons to version 1.7.4 or later. The affected versions are 1.6.0 through 1.7.3.