A missing capability check in the get_content_editor function of the Xpro Addons plugin for Elementor allows unauthenticated users to create and publish Xpro templates. The flaw is a classic missing authorization error (CWE‑862), giving attackers the ability to inject content into the site from outside the normal permission model. This can be used to display arbitrary or malicious templates that compromise the site's appearance and trust integrity.

The issue affects all versions of Xpro Addons for Elementor up to and including 1.5.0. Administrators using WordPress sites with this plugin installed are therefore exposed until a newer, patched release is applied.

The CVSS score of 5.3 places the vulnerability in the moderate range. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting it has not yet been widely exploited. Attackers can exploit the flaw over the web interface without authentication, creating harmless or malicious templates. The lack of a pre‑authentication barrier increases the likelihood of exploitation compared to higher‑privilege attacks, but the impact remains localized to content authority rather than system compromise.