CVE-2026-83547: Xpro Addons WordPress XSS Vulnerability

CVE-2026-83547 Overview

CVE-2026-83547 is a Stored Cross-Site Scripting (XSS) vulnerability in the Xpro Addons WordPress plugin versions prior to 1.7.4. The plugin fails to properly escape widget setting values before rendering them within HTML attributes. Authenticated users holding the Contributor role or higher can inject arbitrary JavaScript that executes in the browser of any user viewing the affected content. The flaw is classified under [CWE-79], improper neutralization of input during web page generation.

Critical Impact

Contributors and other low-privileged authenticated users can persist malicious JavaScript into WordPress pages, enabling session theft, administrative action abuse, and further site compromise when higher-privileged users load the poisoned content.

Affected Products

• Xpro Addons for Elementor (WordPress plugin)
• Versions prior to 1.7.4
• WordPress installations exposing the Contributor role or higher to untrusted authors

Discovery Timeline

• 2026-09-02 - CVE-2026-83547 published to NVD
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-83547

Vulnerability Analysis

The Xpro Addons plugin exposes widget configuration fields that ultimately render inside HTML attribute contexts on the front end. The plugin passes several of these settings to output routines without applying an attribute-safe escaping function such as esc_attr(). An attacker with edit access to a page or post can supply a payload that closes the current attribute and injects new attributes or event handlers. When another user views the rendered page, the injected script executes under that user's session and origin.

Because the stored payload persists in the WordPress database, the attack requires no ongoing attacker interaction. Any subsequent page render replays the payload against every visitor, including administrators.

Root Cause

The root cause is missing output encoding in widget rendering paths within the plugin. Widget settings that flow into HTML attribute positions are concatenated into markup without escaping quotes, angle brackets, or attribute delimiters. WordPress provides esc_attr() for exactly this context, but affected widgets in versions before 1.7.4 do not invoke it consistently.

Attack Vector

Exploitation requires an authenticated account with at least the Contributor role. The attacker edits or creates content that embeds an affected Xpro widget, then supplies an XSS payload in one of the vulnerable settings. On save, the payload persists. When an administrator or other user previews or publishes the content, the script runs in their session context and can perform actions such as creating new administrator accounts, exfiltrating nonces, or planting backdoors.

See the WPScan Vulnerability Report for reproduction details.

Detection Methods for CVE-2026-83547

Indicators of Compromise

• Widget or post metadata in wp_postmeta containing <script, onerror=, onload=, or javascript: strings within Xpro widget settings.
• Unexpected administrator or editor accounts created shortly after a Contributor edited a page containing Xpro widgets.
• Outbound requests from administrator browsers to unfamiliar domains immediately after loading pages that use Xpro widgets.

Detection Strategies

• Audit posts, pages, and templates that embed Xpro Addons widgets for suspicious attribute values, particularly quotes followed by event handler attributes.
• Review WordPress user activity logs for Contributor accounts editing pages that are later modified by administrators.
• Compare installed plugin versions against 1.7.4 across all managed WordPress sites.

Monitoring Recommendations

• Alert on new administrator role assignments and on changes to wp_users or wp_usermeta following content edits by lower-privileged accounts.
• Monitor web server logs for requests to wp-admin/admin-ajax.php and wp-json/ endpoints that follow the load of pages containing Xpro widgets.
• Enable a Content Security Policy that reports inline script execution to a logging endpoint.

How to Mitigate CVE-2026-83547

Immediate Actions Required

• Update the Xpro Addons plugin to version 1.7.4 or later on every WordPress site.
• Review Contributor, Author, and Editor accounts and remove any that are unused or unrecognized.
• Inspect content created or modified by non-administrator accounts for injected script payloads and revert affected revisions.

Patch Information

The vendor addressed the issue in Xpro Addons version 1.7.4 by applying proper attribute escaping to the affected widget settings. Administrators should install this release through the WordPress plugin updater or by deploying the updated package from the plugin repository. Refer to the WPScan Vulnerability Report for the fixed version reference.

Workarounds

• Restrict the Contributor role and above to trusted users only until the plugin is updated.
• Temporarily deactivate the Xpro Addons plugin on sites that cannot be patched immediately.
• Deploy a web application firewall rule that blocks common XSS payload patterns in POST requests to wp-admin/post.php and REST API editing endpoints.

# Configuration example: update Xpro Addons via WP-CLI
wp plugin update xpro-elementor-addons --version=1.7.4
wp plugin list --name=xpro-elementor-addons --fields=name,status,version