Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Widget's 'onClick Event' setting in all versions up to, and including, 1.4.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-04 | 1 | Disclosure1 |
| 2026-04-10 | 1 | PoC1 |
CVE-2025-13368 The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Widget's 'onClick Event' setting in all… https://www.cve.org/CVERecord?id=CVE-2025-13368
Post summary
The Xpro Addons Elementor plugin is vulnerable to stored XSS via the Pricing Widget's onClick event, but no PoC, exploit, patch, or active exploitation details are provided.
https://atomicedge.io/cve-proof/cve-2025-13368-xpro-elementor-addons-version-1-4-20-medium-vulnerability-proof-of-concept CVE-2025-13368 #WordPress plugin #vulnerability xpro-elementor-addons #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
A proof‑of‑concept for CVE‑2025‑13368 targeting Xpro Elementor Addons 1.4.20 is publicly shared, with a CVSS medium rating, but no exploitation code, patch, or active exploitation details are provided.