CVE-2026-83547

Name of the Vulnerable Software and Affected Versions Xpro Addons versions prior to 1.7.4

Description The plugin fails to properly escape settings for several widgets before they are rendered within HTML attributes. This flaw allows users with the Contributor role or higher to execute Stored Cross-Site Scripting (XSS) attacks, which occur when a malicious script is permanently stored on the target server and served to other users.

Recommendations Update to version 1.7.4 or later.