CVE-2026-11614: Xpro Addons for Elementor XSS Vulnerability

CVE-2026-11614 Overview

CVE-2026-11614 is a Stored Cross-Site Scripting (XSS) vulnerability in the Xpro Addons — 140+ Widgets for Elementor plugin for WordPress. The flaw affects all plugin versions up to and including 1.7.2. It originates from insufficient input sanitization and output escaping on the custom_attributes parameter handled across multiple widget frontends. Authenticated users with author-level access or above can inject arbitrary JavaScript into pages. The injected payload executes in the browser of any visitor who loads an affected page, enabling session theft, forced redirects, or administrative action abuse via CSRF chaining. The vulnerability is tracked under CWE-79 and was remediated in version 1.7.3.

Critical Impact
Authenticated contributors and authors can persistently store JavaScript that runs in every site visitor's browser, including administrators, enabling account takeover and content manipulation.

Affected Products

Xpro Addons — 140+ Widgets for Elementor plugin for WordPress, versions ≤ 1.7.2
WordPress sites permitting author-level or higher registrations using the plugin
Multi-author WordPress deployments running vulnerable widget layouts (Button, Hero Slider, Icon Box, Team, Pricing, Promo Box, Site Logo, Site Title, Author Box, Animated Link, Hot Spot, Image Scroller, Info List)

Discovery Timeline

2026-06-24 - CVE-2026-11614 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-11614

Vulnerability Analysis

The vulnerability resides in how the Xpro Addons plugin processes the custom_attributes parameter exposed by many of its Elementor widgets. The helper function responsible for parsing custom attribute strings, located in inc/helper-functions.php, fails to apply adequate sanitization before the values are rendered into HTML attribute context by widget frontend templates. Numerous widget templates pass attacker-controlled data into the DOM, including widgets/button/layout/frontend.php, widgets/hero-slider/layout/frontend.php, widgets/icon-box/layout/frontend.php, and widgets/team/layout/frontend.php. Because the payload is persisted in post meta when an author saves an Elementor page, the injection survives across sessions and impacts every subsequent visitor.

Root Cause

The root cause is missing output escaping when emitting custom_attributes values inside HTML element attributes. The helper splits attribute pairs but does not run the resulting key and value through esc_attr() or an equivalent context-aware encoder. Any user with the edit_posts capability can submit attribute strings containing event handlers such as onmouseover or quote-breaking sequences that escape the intended attribute and inject script content.

Attack Vector

Exploitation requires authenticated access at author level or higher. The attacker edits or creates an Elementor page, adds a vulnerable widget, and supplies a malicious payload through the widget's Custom Attributes field in the Advanced tab. After saving, the page renders the payload verbatim into the widget's outer HTML element. When an administrator previews or visits the page, the script executes with the administrator's session, enabling actions such as creating new admin users, modifying plugin code, or exfiltrating nonces. The attack is purely network-based and requires no further user interaction beyond loading the affected page.

For implementation specifics, refer to the Xpro Elementor Addons helper-functions.php source and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-11614

Indicators of Compromise

Unexpected <script> tags, onerror, onload, or onmouseover handlers stored inside Elementor _elementor_data post meta entries.
New WordPress administrator accounts created shortly after an author edited or published a page using Xpro widgets.
Outbound browser requests from admin sessions to unfamiliar external domains immediately after loading pages built with Xpro Addons.
Modified wp_options entries (such as siteurl or home) or unexpected changes to active theme or plugin files following content edits by author-level users.

Detection Strategies

Query the wp_postmeta table for _elementor_data rows containing strings such as javascript:, onerror=, onload=, or <script within custom_attributes blocks.
Inspect HTTP response bodies served by pages using Xpro Addons widgets for script content inside HTML element attributes generated by the widget templates listed in the advisory.
Correlate WordPress audit logs of post edits by non-admin authors with subsequent privileged actions (user creation, role change, plugin install) within the same browser session.

Monitoring Recommendations

Enable verbose logging of WordPress REST API and admin-ajax.php activity, with attention to Elementor save endpoints originating from author-level accounts.
Deploy a Web Application Firewall (WAF) rule set that flags HTML attribute payloads containing event handlers or javascript: schemes posted to Elementor endpoints.
Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution on pages rendered by the affected plugin.

How to Mitigate CVE-2026-11614

Immediate Actions Required

Update the Xpro Addons — 140+ Widgets for Elementor plugin to version 1.7.3 or later on all WordPress installations.
Audit existing Elementor pages for unauthorized script content in custom_attributes fields and remove any unexpected payloads.
Review and rotate credentials for WordPress administrator accounts that may have visited affected pages during the exposure window.
Restrict author-level and contributor-level account creation, and review existing low-privilege accounts for legitimacy.

Patch Information

The vendor addressed the vulnerability in Xpro Addons version 1.7.3. The fix introduces proper escaping in the helper function at inc/helper-functions.php line 1069 and updates affected widget templates such as widgets/image-scroller/layout/frontend.php to render attribute values safely. Administrators should apply the update through the WordPress plugin dashboard or via WP-CLI.

Workarounds

Temporarily revoke the edit_posts capability from author-role accounts until the patch is applied, limiting page authoring to trusted editor and administrator roles.
Deploy a WAF rule blocking POST requests to Elementor save endpoints that contain custom_attributes values with script-like syntax.
Enforce a strict Content Security Policy disallowing inline scripts on the public site to limit payload execution if exploitation occurs.

bash

# Update Xpro Addons via WP-CLI to the patched version
wp plugin update xpro-elementor-addons --version=1.7.3
wp plugin status xpro-elementor-addons

# Audit Elementor post meta for suspicious custom_attributes payloads
wp db query "SELECT post_id, LEFT(meta_value, 200) FROM wp_postmeta \
  WHERE meta_key='_elementor_data' \
  AND (meta_value LIKE '%custom_attributes%onerror%' \
       OR meta_value LIKE '%custom_attributes%onload%' \
       OR meta_value LIKE '%custom_attributes%<script%' \
       OR meta_value LIKE '%custom_attributes%javascript:%');