The ’Site Title’ widget in Xpro Addons for Elementor allows an authenticated user with Contributor or higher privileges to inject arbitrary JavaScript through its title_tag and html_tag fields because the input is not properly sanitized or escaped. When the affected page is viewed, the malicious script runs in the visitor’s browser, giving the attacker potential to steal credentials, hijack sessions, or perform defacement. This is a classic stored XSS flaw (CWE‑79).

All systems running Xpro Addons – 140+ Widgets for Elementor up to and including version 1.4.6.8 are susceptible. The issue does not affect newer releases such as 1.4.7.1 and later.

With a CVSS score of 6.4, the vulnerability carries a moderate risk to confidentiality, integrity, and availability. The EPSS score is below 1 %, indicating a low probability of active exploitation today, and the flaw is not listed in the CISA KEV catalog. However, because the attack requires only Contributor‑level access, an attacker who can compromise a legitimate contributor account can embed malicious code that will execute for anyone who views the affected page. The stored nature of the flaw means the damage persists until the plugin is patched or the content sanitized.