Xpro vulnerabilities
We track 4 vulnerabilities in Xpro products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 22, 2026.
Latest Xpro vulnerabilities
- 8.8 High severity
Xpro Elementor Addons: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue affects Xpro Elementor Addons: from n/a through 1.7.10.
- 8.5 High severity
Xpro Elementor Addons: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Blind SQL Injection.This issue affects Xpro Elementor Addons: from n/a through <= 1.5.1.
- 9.1 Critical severity
Xpro Elementor Addons: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Upload a Web Shell to a Web Server.This issue affects Xpro Elementor Addons: from n/a through <= 1.4.19.1.
- 8.0 High severity
Xpro Addons — 140+ Widgets for Elementor: Deserialization of Untrusted Data
The 140+ Widgets | Best Addons For Elementor – FREE for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.3.1 via deserialization of untrusted input in the 'export_content' function. This allows authenticated attackers, with