CVE-2026-84088 Overview
CVE-2026-84088 is a stored Cross-Site Scripting (XSS) vulnerability in the Xpro Addons — 140+ Widgets for Elementor WordPress plugin in versions before 1.7.9. The plugin fails to validate or sanitize a widget link setting before storing it and using it in a JavaScript navigation call. Authenticated users with the contributor role or above can inject JavaScript that executes in the browser of any user interacting with the affected widget. The flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Contributor-level accounts can persist arbitrary JavaScript into published content, enabling session theft, administrative action forgery, and site defacement against higher-privileged visitors.
Affected Products
- Xpro Addons — 140+ Widgets for Elementor (WordPress plugin) versions prior to 1.7.9
- WordPress sites permitting contributor-or-above account registration
- Any Elementor-powered site rendering the affected widget to end users
Discovery Timeline
- 2026-09-16 - CVE-2026-84088 published to the National Vulnerability Database
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-84088
Vulnerability Analysis
The vulnerability resides in how the Xpro Addons plugin handles a widget link configuration setting. When an editor configures the widget, the plugin accepts a link value from the request and stores it without validation or output encoding. At render time, the stored value is embedded into a JavaScript navigation call on the front end.
Because the value flows directly into an executable JavaScript context, an attacker who controls the setting can break out of the intended string literal and inject arbitrary script. The payload persists inside the post or template and executes for every visitor that loads the widget, including administrators. The vulnerability requires an authenticated session at the contributor level or higher, along with victim interaction with the rendered widget.
Root Cause
The root cause is missing input validation and missing output encoding on a user-controlled widget setting. The plugin trusts the link value supplied by lower-privileged authors and inserts it into a client-side JavaScript sink without applying esc_url(), esc_js(), or an equivalent context-appropriate escape. This violates the WordPress principle of escaping late and escaping for the correct output context.
Attack Vector
An attacker first obtains a WordPress account with contributor privileges or higher, a common baseline on multi-author sites. Using the Elementor editor, the attacker configures the vulnerable widget and supplies a crafted link value containing JavaScript. The malicious content is saved through the plugin's settings handler and stored in the WordPress database.
When a visitor renders the page and interacts with the widget, the browser executes the injected script under the site's origin. See the WPScan Vulnerability Report #15940 for technical details.
Detection Methods for CVE-2026-84088
Indicators of Compromise
- Widget link settings containing javascript: URIs, HTML event handlers such as onclick=, or <script> tags stored inside Elementor post meta.
- Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages rendering Xpro widgets.
- Contributor or author accounts editing or creating posts that embed Xpro Addons widgets outside of expected editorial workflows.
Detection Strategies
- Query the wp_postmeta table for Elementor data blobs referencing Xpro widget keys, and inspect stored link fields for script payloads or javascript: schemes.
- Enable a Content Security Policy in report-only mode to surface inline script executions and unexpected script sources on published pages.
- Review Elementor revision history for widget edits made by contributor-level accounts that introduce link values containing angle brackets, parentheses, or on* handler substrings.
Monitoring Recommendations
- Alert on new or modified widget configurations submitted by non-editor accounts through WordPress audit logging plugins.
- Monitor WordPress access logs for POST requests to admin-ajax.php or the Elementor save endpoint from low-privileged users editing Xpro widgets.
- Track browser-side JavaScript errors and CSP violations reported from public pages to identify active exploitation attempts.
How to Mitigate CVE-2026-84088
Immediate Actions Required
- Update the Xpro Addons — 140+ Widgets for Elementor plugin to version 1.7.9 or later on all affected WordPress installations.
- Audit contributor, author, and editor accounts, disabling any that are unused, unrecognized, or show suspicious recent activity.
- Review all posts and templates using Xpro widgets for previously injected payloads and sanitize or remove offending link values.
Patch Information
The vendor addressed the flaw in Xpro Addons version 1.7.9. Administrators should upgrade through the WordPress plugin manager or by replacing the plugin files with the fixed release. Confirm the running version under Plugins after upgrade. Refer to the WPScan advisory for release confirmation.
Workarounds
- Temporarily restrict contributor and author roles from using the Elementor editor or the Xpro Addons widgets until patching is complete.
- Deploy a strict Content Security Policy that disallows inline scripts and javascript: URIs to blunt exploitation of stored payloads.
- Place the site behind a web application firewall with rules that block widget save requests containing <script> tags, javascript: schemes, or HTML event handlers.
# Configuration example: WP-CLI upgrade and account audit
wp plugin update xpro-elementor-addons --version=1.7.9
wp user list --role=contributor --fields=ID,user_login,user_registered
wp user list --role=author --fields=ID,user_login,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
