CVE-2026-84088

Name of the Vulnerable Software and Affected Versions Xpro Addons — 140+ Widgets for Elementor WordPress plugin versions prior to 1.7.9

Description The plugin fails to validate or sanitize a widget link setting before it is stored and subsequently used in a JavaScript navigation call. This allows users with the contributor role or higher to perform a stored cross-site scripting attack by injecting JavaScript that executes in the browser of any user who interacts with the affected widget.

Recommendations Update Xpro Addons — 140+ Widgets for Elementor WordPress plugin to version 1.7.9 or later.