CVE-2026-11614: Stored XSS in Xpro Addons for Elementor WordPress Plugin v1.7.2

Technical summary

The vulnerability stems from inadequate input sanitization and output escaping of the 'custom_attributes' parameter across the plugin's widget functionality. An attacker with author or administrator privileges can craft a malicious request containing JavaScript payloads in this parameter. Because the plugin fails to properly sanitize input before storage and escape output before rendering, the script executes in the context of any user's browser session when they load the page. This is a Type-1 stored XSS vulnerability (CWE-79) with a cross-site impact due to the CVSS vector indicating scope change (S:C).

Business impact

Organizations using this plugin face potential compromise of user accounts and site integrity. If an administrator or author account is compromised, or if a malicious insider exists with those privileges, they can inject persistent scripts that target all visitors. This could lead to credential harvesting, malware distribution, unauthorized account creation, or defacement. The reputational damage from a compromised website can be significant, particularly if user data is exfiltrated or if the site becomes a vector for attacks against visitors.

Affected systems

All installations of the Xpro Addons plugin through version 1.7.2 are affected. The vulnerability requires authentication with author-level access or above, meaning the risk is primarily from compromised accounts, insider threats, or multi-user WordPress environments where author permissions are broadly granted. Sites with stricter access controls limiting author roles to trusted individuals face lower practical risk.

Exploitability

The vulnerability requires authenticated access with author-level permissions or higher, which raises the bar for opportunistic attackers. However, it is not listed in the CISA Known Exploited Vulnerabilities catalog, meaning active exploitation in the wild has not yet been documented as of the vulnerability's publication. The attack surface depends on how many accounts with author or admin privileges exist on the target WordPress installation. The technical exploit itself is straightforward—injecting JavaScript into a parameter—making it trivial once access is obtained.

Remediation

Update the Xpro Addons plugin to a version released after 1.7.2 that patches the insufficient sanitization and output escaping. Verify the patched version against the plugin's official repository or vendor advisory before deployment. Additionally, audit WordPress user roles and revoke author-level access for any accounts that no longer require it. Review recent posts and pages for suspicious custom_attributes values that may indicate prior exploitation.

Patch guidance

Visit the WordPress plugin repository or check your WordPress dashboard for an available update to Xpro Addons. Apply the update as soon as it becomes available. Before updating, back up your WordPress database and test the update in a staging environment if the plugin is critical to your site's functionality. After patching, verify that widgets render correctly and that no existing posts or pages contain injected scripts. If you identify suspicious custom_attributes values, manually review and sanitize affected content or restore from a clean backup.

Detection guidance

Search your WordPress posts and pages for unusual or suspicious content in the custom_attributes parameter—look for script tags, event handlers (onclick, onerror, onload), or base64-encoded content. Check WordPress user activity logs for author or admin accounts creating or modifying pages around the time of suspected compromise. Monitor the plugin's release notes and security advisories for patch announcements. Use WordPress security plugins with malware scanning capabilities to detect injected scripts. Review your WordPress database directly if you suspect infection: query post meta and post content for <script>, javascript:, or other XSS indicators.

Why prioritize this

Although this is a medium-severity vulnerability (CVSS 6.4) with limited exploitability due to authentication requirements, it carries meaningful risk for multi-user WordPress environments and any organization where author accounts have been compromised. Stored XSS is more dangerous than reflected XSS because it affects all visitors persistently. The lack of active exploitation and the requirement for privileged credentials temper urgency, but sites with high-value content or visitor bases should prioritize patching to prevent account takeover or malware delivery campaigns.

Risk score, explained

The CVSS 6.4 (Medium) score reflects: network-based attack vector (AV:N), low attack complexity (AC:L), and requirement for low-privileged authentication (PR:L). The vulnerability changes scope (S:C), affecting resources beyond the vulnerable component, and causes both confidentiality and integrity impact (C:L, I:L). The lack of availability impact (A:N) and the authentication requirement prevent a higher score. In context, the lack of known active exploitation and the need for attacker persistence (the script must remain undetected in the database) somewhat mitigate real-world risk, but the stored nature of the XSS makes it a sustained threat.

Frequently asked questions