The Xpro Addons WordPress plugin, versions before 1.7.4, fails to escape certain widget settings, allowing a user with Contributor role or higher to inject malicious script into HTML attributes. This stored cross‑site scripting can lead to defacement, cookie theft, or session hijacking when other visitors load pages containing the affected widgets. The vulnerability aligns with CWE‑79.

Affected systems include the Xpro Addons plugin for WordPress, specifically all releases earlier than 1.7.4 on which the problematic widgets are installed. Site owners using any version of the plugin before the 1.7.4 update are at risk.

The CVSS score of 6.8 indicates a medium severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a Contributor or higher role; the attacker must access the widget settings and insert script payloads that are then stored and executed in the browser of any visitor. The feasibility depends on internal access or compromised contributor accounts, so the risk is bounded to sites with vulnerable plugins and exposed contributor privileges.