medium5.3
CVE-2026-84146
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce …
Impact
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).
Affected products
| Product | Affected versions |
|---|---|
| Xpro Addons — 140+ Widgets For Elementor WordPress Plugin | before 1.7.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.