CVE-2026-84146
Received Received - Intake

XSS via Unauthorized WooCommerce Product Data Exposure in Xpro Addons

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: WPScan

Description
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-84146
EUVD
EUVD-2026-70913

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
xpro addons to 1.7.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Xpro Addons WordPress plugin before version 1.7.8 allows unauthenticated visitors to access sensitive details of non-public WooCommerce products. The plugin fails to check user permissions or product status before displaying information like titles, prices, SKUs, descriptions, and stock levels through the Quick View feature.

Detection Guidance

To detect this vulnerability, check if your Xpro Addons plugin version is below 1.7.8. You can use WordPress commands like 'wp plugin list' or inspect the plugin files directly. Additionally, monitor network requests for unauthorized access to unpublished WooCommerce product details.

Impact Analysis

Unauthenticated attackers could retrieve confidential product data from draft, pending, private, or scheduled WooCommerce products. This exposes sensitive business information such as pricing, inventory, and product details that should not be publicly visible.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by exposing sensitive product information to unauthorized parties. Unpublished product details may contain personal or proprietary data that requires protection under these standards.

Mitigation Strategies

Immediately update the Xpro Addons plugin to version 1.7.8 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review server logs for suspicious access attempts to unpublished products.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84146. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart