Description

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-02T15:17:45.143Z",
  "pubdate": "2026-09-02T15:17:45.143Z",
  "executiveSummary": "The Xpro Addons WordPress plugin, specifically versions prior to 1.7.4, contains a Stored Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability arises from improper sanitization and output encoding of widget settings.\nAn authenticated user with at least Contributor-level privileges can inject malicious JavaScript into plugin settings, which is then rendered within HTML attributes during page output.\nSuccessful exploitation allows for the execution of arbitrary scripts in the context of an administrator or other user's session.\nThe primary risk involves account takeover, session hijacking, or unauthorized administrative actions performed via the victim's browser.\nThe flaw stems from insufficient input validation on the backend, allowing untrusted data to reach the browser environment without proper sanitization.\nThis vulnerability highlights a failure in enforcing secure output handling practices for user-controlled settings.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Xpro Addons plugin to properly sanitize or escape user-supplied data within its widget configuration fields before rendering that data into the HTML output.\nIn WordPress, plugin widgets often store configuration settings in the database. When these settings are later retrieved and injected into HTML attributes, they must be processed through WordPress sanitization and escaping functions (such as esc_attr() or esc_html()) to prevent injection attacks.\nThe vulnerability occurs because the plugin handles widget settings without applying these necessary security controls. A user with Contributor privileges, who has the capability to edit posts and configure certain plugin widgets, can inject malicious payloads into these setting fields.\nThe attack flow begins when the authenticated Contributor modifies a vulnerable widget setting, embedding a payload, such as '\" onmouseover=\"alert(document.cookie)\"'.\nBecause the input is not sanitized or escaped during the save process or the output generation, the payload is stored directly in the database. When an administrator or any other user views the page where the widget is rendered, the payload is injected into the HTML attribute of the page's source code.\nWhen the victim's browser parses the injected HTML, the malicious attribute triggers the execution of the JavaScript payload. Since this execution happens in the authenticated victim's browser session, the script inherits the victim's privileges.\nThis allows the attacker to perform actions such as stealing session cookies, redirecting users to malicious sites, or performing unauthorized administrative tasks on the WordPress instance.\nThe vulnerability affects Xpro Addons plugin versions prior to 1.7.4. It requires a valid, authenticated session with at least Contributor-level access to the WordPress dashboard, making this a medium-to-high severity issue depending on the site's configuration."
}