CVE-2026-11614
Description
The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attributes' parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Summary dbcve.org
Stored XSS vulnerability in the Xpro Addons plugin for WordPress allows authenticated authors+ to inject malicious scripts via the 'custom_attributes' parameter due to insufficient input sanitization and output escaping.
Mitigation
Update the plugin to version 1.7.3 or later when available; otherwise, add proper sanitization (e.g., sanitize_text_field) and output escaping (e.g., esc_attr) to the custom_attributes parameter handling.