CVE-2026-84088: Xpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget
Published Sep 16, 2026
·Updated
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.
Affected Software
1 affected component
Xpro Addons — 140+ Widgets for Elementor (WordPress plugin)<1.7.9
Event History
Sep 16, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A user with the WordPress contributor role or any higher-privileged role can exploit it by supplying malicious JavaScript in the affected widget's link setting.
2
When does the injected JavaScript run?
The JavaScript executes in the browser of a user who interacts with the affected Interactive Circle widget.
3
What versions are affected?
Versions of Xpro Addons — 140+ Widgets for Elementor before 1.7.9 are affected.