medium6.8
CVE-2026-84088
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a…
Impact
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.
Affected products
| Product | Affected versions |
|---|---|
| Xpro Addons — 140+ Widgets For Elementor WordPress Plugin | before 1.7.9 |
Versions were read from the advisory text. No structured product data has been published for this record yet.