CVE-2025-15369

MediumCVSS 5.3

Published: 20/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Missing capability check in the get_content_editor function of the Xpro Addons plugin for WordPress allows unauthenticated attackers to create published Xpro templates.

Risk Assessment

Risk of unauthorized creation and publication of content on the WordPress site.

Recommendation

Update the Xpro Addons plugin to version 1.5.1 or later.

Original NVD description (English source)

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_content_editor function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to create published Xpro templates.