CVE-2026-11614

Description

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attributes' parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PUBLISHED Reserved 2026-06-08 | Published 2026-06-24 | Updated 2026-06-24 | Assigner Wordfence

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Timeline

Credits

Huazu Jiang finder

References

www.wordfence.com/...-8e28-4fa4-bf2b-eefedffa4d72?source=cve

plugins.trac.wordpress.org/...e-scroller/layout/frontend.php

plugins.trac.wordpress.org/...e-scroller/layout/frontend.php

plugins.trac.wordpress.org/...s/icon-box/layout/frontend.php

plugins.trac.wordpress.org/...s/icon-box/layout/frontend.php

plugins.trac.wordpress.org/...ets/button/layout/frontend.php

plugins.trac.wordpress.org/...s/hot-spot/layout/frontend.php

plugins.trac.wordpress.org/.../promo-box/layout/frontend.php

plugins.trac.wordpress.org/.../site-logo/layout/frontend.php

plugins.trac.wordpress.org/...site-title/layout/frontend.php

plugins.trac.wordpress.org/...mated-link/layout/frontend.php

plugins.trac.wordpress.org/...ts/pricing/layout/frontend.php

plugins.trac.wordpress.org/...ero-slider/layout/frontend.php

plugins.trac.wordpress.org/...author-box/layout/frontend.php

plugins.trac.wordpress.org/.../info-list/layout/frontend.php

plugins.trac.wordpress.org/...dgets/team/layout/frontend.php

plugins.trac.wordpress.org/...trunk/inc/helper-functions.php

plugins.trac.wordpress.org/...1.7.3/inc/helper-functions.php

plugins.trac.wordpress.org/...e-scroller/layout/frontend.php

cve.org (CVE-2026-11614)

nvd.nist.gov (CVE-2026-11614)

Download JSON