CVE-2025-15369 is a missing authorization vulnerability (CWE-862) in the Xpro Addons — 140+ Widgets for Elementor WordPress plugin. The issue arises from the absence of a capability check in the get_content_editor function, enabling unauthenticated users to create published templates. This affects all versions up to and including 1.5.0. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or official remediation has been disclosed by the vendor as of the published date.

An unauthenticated attacker can create published templates within the Xpro Addons plugin, leading to unauthorized modification of data. This could affect the integrity of content managed by the plugin but does not impact confidentiality or availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to plugin management interfaces and monitoring for unauthorized template creation. Avoid deploying this plugin in environments where untrusted users have access.