# cve.now: Xpro

The newest entries naming Xpro as an affected vendor (up to 200), of 27 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-114177](https://cve.now/CVE-2026-114177.md): WordPress Xpro Elementor Addons plugin \<= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
- [CVE-2026-7105](https://cve.now/CVE-2026-7105.md): Xpro Addons \<= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get\_menu\_content\_editor() Function (CVSS 4.3)
- [CVE-2026-11614](https://cve.now/CVE-2026-11614.md): Xpro Addons \<= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom\_attributes' Parameter of Multiple Widgets (CVSS 6.4)
- [CVE-2025-15369](https://cve.now/CVE-2025-15369.md): Xpro Addons — 140+ Widgets for Elementor \<= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation (CVSS 5.3)
- [CVE-2026-45214](https://cve.now/CVE-2026-45214.md): WordPress Xpro Elementor Addons plugin \<= 1.5.1 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-13368](https://cve.now/CVE-2025-13368.md): Xpro Addons — 140+ Widgets for Elementor \<= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2026-2949](https://cve.now/CVE-2026-2949.md): Xpro Addons — 140+ Widgets for Elementor \<= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget (CVSS 6.4)
- [CVE-2026-32395](https://cve.now/CVE-2026-32395.md): WordPress Xpro Addons For Beaver Builder – Lite plugin \<= 1.5.6 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-14149](https://cve.now/CVE-2025-14149.md): Xpro Addons — 140+ Widgets for Elementor \<= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link (CVSS 6.4)
- [CVE-2025-69312](https://cve.now/CVE-2025-69312.md): WordPress Xpro Elementor Addons plugin \<= 1.4.19.1 - Arbitrary File Upload vulnerability (CVSS 9.1)
- [CVE-2025-63044](https://cve.now/CVE-2025-63044.md): WordPress Xpro Elementor Addons plugin \<= 1.4.19.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-58198](https://cve.now/CVE-2025-58198.md): WordPress Xpro Theme Builder Plugin \<= 1.2.9 - Broken Access Control Vulnerability (CVSS 6.5)
- [CVE-2025-58195](https://cve.now/CVE-2025-58195.md): WordPress Xpro Elementor Addons Plugin \<= 1.4.17 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-48232](https://cve.now/CVE-2025-48232.md): WordPress Xpro Addons For Beaver Builder – Lite plugin \<= 1.5.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-32201](https://cve.now/CVE-2025-32201.md): WordPress Xpro Theme Builder Plugin \<= 1.2.8.4 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-32163](https://cve.now/CVE-2025-32163.md): WordPress Xpro Elementor Addons plugin \<= 1.4.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-2108](https://cve.now/CVE-2025-2108.md): 140+ Widgets | Xpro Addons For Elementor – FREE \<= 1.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Site Title' widget (CVSS 6.4)
- [CVE-2024-13649](https://cve.now/CVE-2024-13649.md): 140+ Widgets | Xpro Addons For Elementor – FREE \<= 1.4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-12584](https://cve.now/CVE-2024-12584.md): 140+ Widgets | Xpro Addons For Elementor – FREE \<= 1.4.6.2 - Authenticated (Contributor+) Post Disclosure via Post Duplication (CVSS 4.3)
- [CVE-2024-54253](https://cve.now/CVE-2024-54253.md): WordPress Xpro Addons For Elementor plugin \<= 1.4.6.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-10319](https://cve.now/CVE-2024-10319.md): 140+ Widgets | Xpro Addons For Elementor – FREE \<= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template (CVSS 4.3)
- [CVE-2024-7791](https://cve.now/CVE-2024-7791.md): 140+ Widgets | Xpro Addons For Elementor – FREE \<= 1.4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Grid Widget (CVSS 6.4)
- [CVE-2024-43150](https://cve.now/CVE-2024-43150.md): WordPress Xpro Elementor Addons plugin \<= 1.4.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-4471](https://cve.now/CVE-2024-4471.md): 140+ Widgets | Best Addons For Elementor – FREE \<= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.0)
- [CVE-2024-4440](https://cve.now/CVE-2024-4440.md): 140+ Widgets | Best Addons For Elementor – FREE \<= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4)
- [CVE-2024-34570](https://cve.now/CVE-2024-34570.md): WordPress Xpro Elementor Addons plugin \<= 1.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-2250](https://cve.now/CVE-2024-2250.md): 130+ Widgets | Best Addons For Elementor – FREE \<= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/xpro
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.