Plugin security history

Xpro Addons — 140+ Widgets for Elementor Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 21 vulnerability records associated with Xpro Addons — 140+ Widgets for Elementor, published between 2024 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

21Total records

0Critical

2High

19Medium

0Low

0Informational

21Patched records

0Currently marked unpatched

2024-03-28First disclosure

2026-06-23Latest disclosure

21 of 21CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2024	8	8 records
2025	6	6 records
2026	7	7 records

Severity Breakdown

Severity	Records	Share
High	2	9.5%
Medium	19	90.5%

Vulnerability-Type Breakdown

Cross-Site Scripting

15 records71.4%

First: 2024. Latest: 2026.

Information Disclosure

2 records9.5%

First: 2024. Latest: 2025.

Other

1 record4.8%

First: 2024. Latest: 2024.

Arbitrary File Upload

1 record4.8%

First: 2026. Latest: 2026.

SQL Injection

1 record4.8%

First: 2026. Latest: 2026.

Missing Authorization

1 record4.8%

First: 2026. Latest: 2026.

Patch Status

Patched: 21
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.7.3
1.5.1
1.4.21
1.5.2
1.4.25
1.4.20
1.4.18
1.4.11
1.4.8
1.4.6.8
1.4.6.3
1.4.6.6
1.4.6.1
1.4.4.4
1.4.4.3
1.4.3.2
1.4.3.1
1.4.3

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-1.7.2`	Xpro Addons <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets	June 23, 2026	1.7.3	Medium
`*-1.5.0`	Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation	May 19, 2026	1.5.1	Medium
`*-1.4.20`	Xpro Addons — 140+ Widgets for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting	April 3, 2026	1.4.21	Medium
`*-1.4.24`	Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget	April 3, 2026	1.4.25	Medium
`*-1.5.1`	Xpro Elementor Addons <= 1.5.1 - Authenticated (Contributor+) SQL Injection	March 30, 2026	1.5.2	Medium
`*-1.4.24`	Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link	February 26, 2026	1.4.25	Medium
`*-1.4.19.1`	Xpro Elementor Addons <= 1.4.19.1 - Authenticated (Author+) Arbitrary File Upload	January 19, 2026	1.4.20	High
`*-1.4.19.1`	Xpro Elementor Addons <= 1.4.19.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	December 6, 2025	1.4.20	Medium
`*-1.4.17`	Xpro Elementor Addons <= 1.4.17 - Authenticated (Contributor+) Stored Cross-Site Scripting	August 27, 2025	1.4.18	Medium
`*-1.4.10`	Xpro Elementor Addons <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting	April 4, 2025	1.4.11	Medium
`*-1.4.7.1`	140+ Widgets \| Xpro Addons For Elementor – FREE <= 1.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Site Title' widget	March 19, 2025	1.4.8	Medium
`*-1.4.6.7`	140+ Widgets \| Xpro Addons For Elementor – FREE <= 1.4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	March 7, 2025	1.4.6.8	Medium
`*-1.4.6.2`	140+ Widgets \| Xpro Addons For Elementor – FREE <= 1.4.6.2 - Authenticated (Contributor+) Post Disclosure via Post Duplication	January 7, 2025	1.4.6.3	Medium
`*-1.4.6.5`	140+ Widgets \| Xpro Addons For Elementor – FREE <= 1.4.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	December 5, 2024	1.4.6.6	Medium
`*-1.4.6`	140+ Widgets \| Xpro Addons For Elementor – FREE <= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template	November 4, 2024	1.4.6.1	Medium
`*-1.4.4.3`	140+ Widgets \| Xpro Addons For Elementor – FREE <= 1.4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Grid Widget	August 26, 2024	1.4.4.4	Medium
`*-1.4.4.2`	Xpro Elementor Addons <= 1.4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	August 7, 2024	1.4.4.3	Medium
`*-1.4.3.1`	140+ Widgets \| Best Addons For Elementor – FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection	May 22, 2024	1.4.3.2	High
`*-1.4.3`	140+ Widgets \| Best Addons For Elementor – FREE <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	May 13, 2024	1.4.3.1	Medium
`*-1.4.3`	140+ Widgets \| Best Addons For Elementor – FREE <= 1.4.3 - Authenticated (Admin+) Cross Site Scripting	May 7, 2024	1.4.3.1	Medium
`*-1.4.2`	130+ Widgets \| Best Addons For Elementor – FREE <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	March 28, 2024	1.4.3	Medium

Selected source records

Latest Records

MediumCVE-2026-11614

Xpro Addons <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets

Published: June 23, 2026

Affected versions: *-1.7.2
Patched versions: 1.7.3

Original Wordfence record

MediumCVE-2025-15369

Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation

Published: May 19, 2026

Affected versions: *-1.5.0
Patched versions: 1.5.1

Original Wordfence record

MediumCVE-2025-13368

Xpro Addons — 140+ Widgets for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: April 3, 2026

Affected versions: *-1.4.20
Patched versions: 1.4.21

Original Wordfence record

MediumCVE-2026-2949

Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget

Published: April 3, 2026

Affected versions: *-1.4.24
Patched versions: 1.4.25

Original Wordfence record

MediumCVE-2026-45214

Xpro Elementor Addons <= 1.5.1 - Authenticated (Contributor+) SQL Injection

Published: March 30, 2026

Affected versions: *-1.5.1
Patched versions: 1.5.2

Original Wordfence record

MediumCVE-2025-14149

Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link

Published: February 26, 2026

Affected versions: *-1.4.24
Patched versions: 1.4.25

Original Wordfence record

HighCVE-2025-69312

Xpro Elementor Addons <= 1.4.19.1 - Authenticated (Author+) Arbitrary File Upload

Published: January 19, 2026

Affected versions: *-1.4.19.1
Patched versions: 1.4.20

Original Wordfence record

MediumCVE-2025-63044

Xpro Elementor Addons <= 1.4.19.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: December 6, 2025

Affected versions: *-1.4.19.1
Patched versions: 1.4.20

Original Wordfence record

Highest-Severity Records

HighCVE-2025-69312

Xpro Elementor Addons <= 1.4.19.1 - Authenticated (Author+) Arbitrary File Upload

Published: January 19, 2026

Affected versions: *-1.4.19.1
Patched versions: 1.4.20

Original Wordfence record

HighCVE-2024-4471

140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection

Published: May 22, 2024

Affected versions: *-1.4.3.1
Patched versions: 1.4.3.2

Original Wordfence record

MediumCVE-2026-45214

Xpro Elementor Addons <= 1.5.1 - Authenticated (Contributor+) SQL Injection

Published: March 30, 2026

Affected versions: *-1.5.1
Patched versions: 1.5.2

Original Wordfence record

MediumCVE-2025-2108

140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Site Title' widget

Published: March 19, 2025

Affected versions: *-1.4.7.1
Patched versions: 1.4.8

Original Wordfence record

MediumCVE-2024-54253

140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: December 5, 2024

Affected versions: *-1.4.6.5
Patched versions: 1.4.6.6

Original Wordfence record

MediumCVE-2024-2250

130+ Widgets | Best Addons For Elementor – FREE <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: March 28, 2024

Affected versions: *-1.4.2
Patched versions: 1.4.3

Original Wordfence record

MediumCVE-2026-11614

Xpro Addons <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets

Published: June 23, 2026

Affected versions: *-1.7.2
Patched versions: 1.7.3

Original Wordfence record

MediumCVE-2024-13649

140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: March 7, 2025

Affected versions: *-1.4.6.7
Patched versions: 1.4.6.8

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory