CVE-2026-84146: Xpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick View

Q: Which installations should be treated as affected?

Installations running Xpro Addons — 140+ Widgets for Elementor before version 1.7.8 should be treated as affected.

Q: Does exploitation require an authenticated WordPress account?

No. An unauthenticated visitor can trigger the issue by supplying a product identifier to render the product summary.

Published Sep 4, 2026

Updated

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).

Affected Software

1 affected component

Xpro Addons — 140+ Widgets for Elementor<1.7.8

Event History

Sep 4, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which installations should be treated as affected?

Installations running Xpro Addons — 140+ Widgets for Elementor before version 1.7.8 should be treated as affected.

Does exploitation require an authenticated WordPress account?

No. An unauthenticated visitor can trigger the issue by supplying a product identifier to render the product summary.