XP
Vendor
Xpro
18
CVEs
0
On KEV
1
New 30D
Products
XE9.1
Xpro Elementor Addons
Xpro
6 CVEs0 on KEV1 new
XA6.5
Xpro Addons — 140+ Widgets for Elementor
xpro
8 CVEs0 on KEV0 new
XA6.5
Xpro Addons For Beaver Builder – Lite
Xpro
2 CVEs0 on KEV0 new
XT6.5
Xpro Theme Builder
Xpro
2 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114177 New | XE Xpro Elementor Addons Xpro | 8.8 | Oct 22 | WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2026-7105 | XA Xpro Addons — 140+ Widgets for Elementor xpro | 4.3 | Aug 5 | Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function |
| CVE-2026-11614 | XA Xpro Addons — 140+ Widgets for Elementor xpro | 6.4 | Jun 24 | Xpro Addons <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets |
| CVE-2025-15369 | XA Xpro Addons — 140+ Widgets for Elementor xpro | 5.3 | May 20 | Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation |
| CVE-2026-45214 | XE Xpro Elementor Addons Xpro | 8.5 | May 12 | WordPress Xpro Elementor Addons plugin <= 1.5.1 - SQL Injection vulnerability |
| CVE-2025-13368 | XA Xpro Addons — 140+ Widgets for Elementor xpro | 6.4 | Apr 4 | Xpro Addons — 140+ Widgets for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2026-2949 | XA Xpro Addons — 140+ Widgets for Elementor xpro | 6.4 | Apr 4 | Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget |
| CVE-2026-32395 | XA Xpro Addons For Beaver Builder – Lite Xpro | 5.3 | Mar 13 | WordPress Xpro Addons For Beaver Builder – Lite plugin <= 1.5.6 - Broken Access Control vulnerability |
| CVE-2025-14149 | XA Xpro Addons — 140+ Widgets for Elementor xpro | 6.4 | Feb 27 | Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link |
| CVE-2025-69312 | XE Xpro Elementor Addons Xpro | 9.1 | Jan 22 | WordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Arbitrary File Upload vulnerability |
| CVE-2025-63044 | XE Xpro Elementor Addons Xpro | 6.5 | Dec 9 | WordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2025-58198 | XT Xpro Theme Builder Xpro | 6.5 | Aug 27 | WordPress Xpro Theme Builder Plugin <= 1.2.9 - Broken Access Control Vulnerability |
| CVE-2025-58195 | XE Xpro Elementor Addons Xpro | 6.5 | Aug 27 | WordPress Xpro Elementor Addons Plugin <= 1.4.17 - Cross Site Scripting (XSS) Vulnerability |
| CVE-2025-48232 | XA Xpro Addons For Beaver Builder – Lite Xpro | 6.5 | May 19 | WordPress Xpro Addons For Beaver Builder – Lite plugin <= 1.5.5 - Cross Site Scripting (XSS) Vulnerability |
| CVE-2025-32201 | XT Xpro Theme Builder Xpro | 4.3 | Apr 4 | WordPress Xpro Theme Builder Plugin <= 1.2.8.4 - Broken Access Control vulnerability |
| CVE-2025-32163 | XE Xpro Elementor Addons Xpro | 6.5 | Apr 4 | WordPress Xpro Elementor Addons plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability |
| CVE-2025-2108 | XA Xpro Addons — 140+ Widgets for Elementor xpro | 6.4 | Mar 20 | 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Site Title' widget |
| CVE-2024-12584 | XA Xpro Addons — 140+ Widgets for Elementor xpro | 6.5 | Jan 8 | 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.2 - Authenticated (Contributor+) Post Disclosure via Post Duplication |