CVE-2026-83547: CWE-79 Cross-Site Scripting (XSS) in Xpro Addons

The Xpro Addons WordPress plugin before version 1.7.4 improperly escapes certain widget settings when rendering them inside HTML attributes. This flaw enables users with Contributor or higher privileges to perform stored Cross-Site Scripting (CWE-79) attacks by injecting malicious scripts that are then executed in the context of other users viewing the affected pages. The vulnerability affects version 1.6.0 explicitly and likely other versions before 1.7.4. No official patch or remediation guidance is currently documented.

Successful exploitation could allow an attacker with Contributor or higher privileges to execute arbitrary JavaScript in the browsers of users who view the affected widgets. This can lead to theft of sensitive information, session hijacking, or other impacts associated with stored XSS. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor and higher roles from accessing or modifying vulnerable widget settings if possible. Monitor for updates from the plugin vendor and apply any official fixes promptly.