This vulnerability is an SQL Injection flaw in the Xpro Elementor Addons WordPress plugin, where special characters are improperly neutralized in database queries. A blind SQL Injection allows an attacker to execute arbitrary SQL commands and read sensitive data from the site’s database, potentially exposing user credentials, site content, or administrative information.

The flaw affects the Xpro Elementor Addons plugin, version 1.5.1 and earlier. No other vendors or products are listed as impacted.

The CVSS score of 8.5 indicates high severity. No EPSS score is available, so the current exploitation likelihood is unclear, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, via crafted HTTP requests to the vulnerable plugin, and it presumably does not require authentication to use the blind injection channel.