The vulnerability is a Cross‑Site Request Forgery (CSRF) flaw in the Xpro Elementor Addons plugin. An attacker can cause an authenticated user to perform unwanted actions, potentially altering plugin settings, compromising data, or executing other privileged operations without the user’s consent. This flaw is categorized as CWE‑352 and directly enables the attacker to manipulate the website’s behavior if the target is logged in.

The affected vendor is Xpro, and the issue applies to the WordPress Xpro Elementor Addons plugin versions up to and including 1.7.10. Any site that has installed the plugin at version 1.7.10 or earlier is vulnerable; newer releases (1.7.11 and above) contain the fix.

The CVSS base score of 8.8 indicates high severity, but the EPSS score is not available so the current exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog, suggesting there are currently no widely reported exploits. The typical attack vector would involve an attacker tricking a logged‑in administrator, editor, or any authenticated user into visiting a crafted URL or loading a malicious webpage that submits a request to the vulnerable endpoint, thereby triggering the unwanted action.