CVE-2026-83547: 
WordPress vulnerability analysis and mitigation

CVE-2026-83547 is a Stored Cross-Site Scripting (XSS) vulnerability in the Xpro Elementor Addons WordPress plugin affecting versions 1.6.0 through 1.7.3. The plugin fails to properly escape widget settings before outputting them within HTML attributes, enabling authenticated users with the Contributor role or above to inject persistent malicious scripts. It was publicly disclosed on September 1–2, 2026, with a patch released in version 1.7.4. The vulnerability carries a CVSS v3.1 base score of 6.8 (Medium), assigned by WPScan and reported by researcher Dmitrii Ignatyev (WPScan, GitHub Advisory).

The root cause is improper output escaping (CWE-79) — the plugin does not sanitize or escape widget configuration values before rendering them inside HTML attributes on the page. An authenticated attacker with at least Contributor-level access can craft malicious widget settings containing JavaScript payloads (e.g., event handler injection via unescaped attribute values), which are then stored in the database and rendered to all visitors loading the affected page or post. Exploitation requires the attacker to have the ability to create or edit content using Elementor widgets provided by the plugin. A proof-of-concept is scheduled for public release on September 15, 2026, to allow time for users to update (WPScan, GitHub Advisory).

Successful exploitation allows an attacker to persistently inject malicious JavaScript into pages viewed by site visitors, including administrators. This can result in session token theft, credential harvesting, unauthorized actions performed on behalf of victims, page content defacement, or redirection to malicious external sites. Because the payload is stored server-side and executes in every visitor's browser, the blast radius extends to all users who view the compromised page, including high-privilege administrators whose sessions could be hijacked to achieve full site takeover (WPScan, GitHub Advisory).

No public proof-of-concept exploit is currently available; WPScan has indicated the PoC will be published on September 15, 2026. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. Exploitation is constrained by the requirement for an authenticated Contributor-level account, reducing the attack surface compared to unauthenticated vulnerabilities (WPScan, GitHub Advisory).

1. Obtain Contributor Access: Register or compromise an account with at least the Contributor role on the target WordPress site running Xpro Elementor Addons versions 1.6.0–1.7.3.
2. Create or Edit a Post/Page: Navigate to the WordPress editor and create or edit a post or page that uses one of the vulnerable Xpro Elementor widgets.
3. Inject Malicious Payload: In the widget settings panel, enter a crafted XSS payload into a vulnerable field (e.g., a text or URL attribute field that is rendered unsanitized into an HTML attribute), such as " onmouseover="alert(document.cookie) or a more sophisticated payload to exfiltrate cookies to an attacker-controlled server.
4. Publish the Content: Save and publish the post or page, causing the malicious payload to be stored in the WordPress database.
5. Trigger Execution: When any site visitor (including administrators) loads the page containing the compromised widget, the injected JavaScript executes in their browser, enabling session hijacking, credential theft, or further malicious actions (WPScan).

• Logs: WordPress access logs showing POST requests to /wp-admin/post.php or the REST API (/wp-json/) from Contributor-level accounts modifying widget settings with unusual encoded or JavaScript-containing values.
• Database: Unexpected JavaScript strings (e.g., <script>, onerror=, onmouseover=, javascript:) stored in the wp_postmeta or wp_posts tables within Elementor widget data (serialized JSON/HTML).
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after loading pages with Xpro Elementor widgets, potentially carrying cookie or session data in query parameters.
• Browser/Client: Unexpected redirects or pop-ups experienced by site visitors on pages using Xpro Elementor Addons widgets; reports of session anomalies from administrators.

Update the Xpro Elementor Addons plugin to version 1.7.4 or later, which contains the fix for improper output escaping. Site administrators should audit all posts and pages using Xpro Elementor widgets for suspicious content, particularly those edited by Contributor-level users. If immediate update is not possible, consider temporarily restricting the Contributor role's ability to publish or edit content, or disabling the plugin until patching is feasible (WPScan, GitHub Advisory).

The vulnerability was discovered and reported by researcher Dmitrii Ignatyev of CleanTalk Research (https://research.cleantalk.org/), who also submitted it to WPScan. No significant broader media coverage or notable community commentary has been identified at this time beyond standard vulnerability database listings.