Xpro Elementor Addons: Cross-Site Request Forgery in WordPress plugin

Summary

The WordPress plugin Xpro Elementor Addons up to and including version 1.7.10 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can craft a malicious page that causes a logged-in user's browser to perform actions on the website without their intent, such as changing passwords or settings. Exploitation requires that a privileged user is tricked into visiting a malicious link or page; the sources describe no direct attack against anonymous visitors.

Affected

• Xpro Elementor Addons WordPress plugin (slug xpro-elementor-addons), versions up to and including 1.7.10
• CVSS 8.8 (v3.1), assigned by Patchstack; NVD status is Deferred

Fixed in

• Update to version 1.7.11 or later (per Patchstack; not independently confirmed by the vendor)

Workaround

• No vendor-specific workaround known.
• Until patched, avoid browsing other websites while logged into the WordPress backend.

Exploitation

• Not marked as known exploited in the sources found.
• VulDB reports no available public exploit.
• Patchstack rates the priority as low and considers exploitation unlikely.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• The vulnerable function and the exact required privilege level are unknown.

Our recommendation

• Update the Xpro Elementor Addons plugin to version 1.7.11 or later and verify the installed version afterwards.
• Check which sites run the plugin and prioritise sites with several backend users (editors, shop staff).
• Ask your hosting provider or web developer for help if the update cannot be applied.
• Monitor the backend for unexpected changes to passwords or settings.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• VulDB CVE record vuldb.com
• VulDB exploit status vuldb.com
• WordPress.org plugin page wordpress.org
• Vulners CVE record vulners.com
• Vulners CVElist record vulners.com
• WPScan plugin page wpscan.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:02.