CVE-2025-13368 is a stored cross-site scripting vulnerability in the Xpro Addons — 140+ Widgets for Elementor WordPress plugin, specifically in the Pricing Widget's 'onClick Event' setting. Authenticated attackers with contributor or higher privileges can inject arbitrary scripts due to improper input sanitization and output escaping. This vulnerability affects all versions up to 1.4.20. The CVSS 3.1 base score is 6.4 (medium severity), with an attack vector of network, low attack complexity, requiring privileges, no user interaction, and impacts on confidentiality and integrity. No patch or official remediation level has been published, and no known exploits are reported.

An attacker with contributor-level access or higher can inject malicious JavaScript code into pages via the vulnerable widget setting. This code executes in the context of users who view the infected page, potentially leading to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality and integrity. Availability is not impacted. Since the vulnerability requires authenticated access, the risk is limited to environments where such users exist.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the affected Pricing Widget if possible. Monitor official vendor channels for updates regarding patches or mitigations.