CVE-2025-0898

Name of the Vulnerable Software and Affected Versions Xpro Elementor Addons - Pro versions prior to 1.4.8

Description The plugin is subject to arbitrary file reading through the Draw SVG widget. This allows authenticated attackers with Contributor-level access or higher to read arbitrary files on the server, potentially exposing sensitive information.

Recommendations Update the plugin to a version later than 1.4.7. As a temporary mitigation, restrict access to the Draw SVG widget for users with Contributor-level permissions.