CVE-2025-63044
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
DOM-Based XSS vulnerability in the Xpro Elementor Addons plugin allows injection of malicious script into the page generated by the plugin. An attacker can exploit this to execute script in the victim's browser.
Risk Assessment
Risk of session hijacking, data theft, or unauthorized actions in the victim's context.
Recommendation
Update the Xpro Elementor Addons plugin to a version newer than 1.4.19.1 if a patch is available.
Other vulnerabilities in Xpro Elementor Addons
See all- CVE-2026-45214High
The Xpro Elementor Addons plugin has an SQL Injection vulnerability that allows for Blind SQL Injection attacks. This issue affects versions from n/a through 1.5.1.
- CVE-2026-114177High
The Xpro Elementor Addons plugin (versions up to and including 1.7.10) is vulnerable to Cross-Site Request Forgery (CSRF). The flaw allows an attacker to force an authenticated user to perform unintended actions.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows DOM-Based XSS.This issue affects Xpro Elementor Addons: from n/a through <= 1.4.19.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS