CVE-2026-45214

WordPress Xpro Elementor Addons plugin <= 1.5.1 - SQL Injection vulnerability

Published May 12, 2026 CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Blind SQL Injection.This issue affects Xpro Elementor Addons: from n/a through <= 1.5.1.

Analysis

Technical impact

This vulnerability is an SQL Injection flaw in the Xpro Elementor Addons WordPress plugin, where special characters are improperly neutralized in database queries. A blind SQL Injection allows an attacker to execute arbitrary SQL commands and read sensitive data from the site’s database, potentially exposing user credentials, site content, or administrative information.

Affected Systems

The flaw affects the Xpro Elementor Addons plugin, version 1.5.1 and earlier. No other vendors or products are listed as impacted.

Risk and Exploitability

The CVSS score of 8.5 indicates high severity. No EPSS score is available, so the current exploitation likelihood is unclear, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, via crafted HTTP requests to the vulnerable plugin, and it presumably does not require authentication to use the blind injection channel.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Xpro

Xpro Elementor Addons

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.5.1

No data.

Vendor Product Versions

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Xpro

Xpro Elementor Addons

Version	Status	Scheme	Platform
`[0,1.5.1]`	affected	semver	—
`1.5.2`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Xpro Elementor Addons to version 1.5.2 or later, which patches the SQL Injection flaw.
If an upgrade is not possible, remove the plugin entirely from the WordPress installation.
Deploy a Web Application Firewall or use query‑safety mechanisms to block suspicious SQL patterns before they reach the database.

Generated by OpenCVE AI on May 12, 2026 at 12:21 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.223% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/xpro-elementor-addons/vulnerability/wordpress-xpro-elementor-addons-plugin-1-5-1-sql-injection-vulnerability?_s_id=cve

History

May 12, 2026 10:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 12, 2026 3:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress Xpro Xpro xpro Elementor Addons
Vendors & Products		Wordpress Wordpress wordpress Xpro Xpro xpro Elementor Addons

May 12, 2026 11:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Blind SQL Injection.This issue affects Xpro Elementor Addons: from n/a through <= 1.5.1.
Title		WordPress Xpro Elementor Addons plugin <= 1.5.1 - SQL Injection vulnerability
Weaknesses		CWE-89
References		https://patchstack.com/database/Wordpress/Plugin/xpro-elementor-addons/vulnerability/wordpress-xpro-elementor-addons-plugin-1-5-1-sql-injection-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}`