CVE-2025-13368

The Xpro Addons plugin for WordPress contains a security weakness in its Pricing Widget's 'onClick Event' setting, which allows malicious users with contributor-level access or higher to introduce unauthorized code into the site. This vulnerability stems from inadequate filtering of input data and failure to properly prevent potentially hazardous content from being displayed on pages. As a result, attackers can embed arbitrary scripts that will be executed whenever a user visits an affected page.

Based on public CVE data (MITRE/NVD).