The Xpro Addons – 140+ Widgets for Elementor plugin contains a stored cross‑site scripting flaw in all releases up to and including 1.7.2. The vulnerability is triggered by the ‘custom_attributes’ parameter used in many widget configurations. If a user with author or higher permissions injects malicious JavaScript into this field, the code is saved to the database and executed for every visitor who loads the affected page.

All WordPress sites running Xpro Addons version 1.7.2 or earlier are affected. The plug‑in provides more than 140 widgets for Elementor, and the stored payload can be placed in any widget that accepts the custom_attributes field.

The CVSS score of 6.4 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must first authenticate to the WordPress back‑end with author‑level or higher permissions to inject the payload. Once injected, the script runs in the context of every user who views the page, allowing potential defacement, cookie theft, session hijacking, or phishing attacks.