CVE-2026-83547
Received Received - Intake

Stored XSS in Xpro Addons WordPress Plugin

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: WPScan

Description
The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-83547
EUVD
EUVD-2026-70047

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
xpro addons to 1.7.4 (exc)
xpro elementor_addons From 1.6.0 (inc) to 1.7.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Xpro Addons WordPress plugin before version 1.7.4. It occurs because the plugin does not properly escape some widget settings before outputting them in HTML attributes. This allows users with Contributor role or higher to inject malicious scripts that are stored on the server and executed when other users view affected pages.

Detection Guidance

Check if the Xpro Addons WordPress plugin version is below 1.7.4. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details.

Impact Analysis

An attacker with Contributor access could inject malicious scripts that steal user sessions, redirect to phishing sites, or perform actions on behalf of users. Visitors to the site may have their data compromised or be exposed to malware. The vulnerability could also be used to deface the website or spread malicious content.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR if personal data is exposed, or HIPAA if protected health information is compromised. Organizations could face fines and legal consequences for failing to protect user data under these regulations.

Mitigation Strategies

Update the Xpro Addons plugin to version 1.7.4 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83547. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart