The xpro Xpro Addons — 140+ Widgets for Elementor WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. This vulnerability allows authenticated users with contributor-level or higher permissions to inject arbitrary JavaScript code into pages via insufficient sanitization and escaping of widget attributes. When other users access these pages, the injected scripts execute in their browsers, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to 1.4.2. No official patch or fix has been documented in the provided data.

Successful exploitation allows an authenticated attacker with contributor-level or higher permissions to inject persistent malicious scripts into pages generated by the plugin's widgets. These scripts execute in the context of users viewing the compromised pages, potentially leading to theft of sensitive information, session tokens, or other client-side attacks. The vulnerability does not affect availability and requires authentication with low privileges, but no user interaction is needed for the script to execute once injected.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor plugin updates from the vendor for a security patch addressing this issue.