CVE Database /
CVE-2024-13649
CVE · Medium
CVE-2024-13649 — Xpro Addons — 140+ Widgets for Elementor [xpro-elementor-addons] < 1.4.6.8
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-13649
|
Xpro Addons — 140+ Widgets for Elementor [xpro-elementor-addons] < 1.4.6.8 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.4
|
< 1.4.6.8
|
1.4.6.8 |
2025-03-07 |
—
|
CVE-2024-13649
The Xpro Addons plugin for Elementor through version 1.4.6.7 contains a stored cross-site scripting vulnerability affecting multiple widgets. Attackers with contributor-level permissions or higher can bypass inadequate input filtering and output encoding to embed malicious scripts into pages. These injected scripts execute for any user who visits the affected pages. The vulnerability was fixed in version 1.4.6.8.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings