CVE-2025-13368
Last modified
CVE-2025-13368 is a medium-severity vulnerability rated 6.4/10 on the CVSS scale. The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Widget's 'onClick Event' setting in all versions up to, and including, 1.4.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Widget's 'onClick Event' setting in all versions up to, and including, 1.4.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-13368?
How severe is CVE-2025-13368?
How do I fix CVE-2025-13368?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-13362The Norby AI plugin for WordPress is vulnerable to Cross-Sit…4.3
- CVE-2025-13363The IMAQ Core plugin for WordPress is vulnerable to Cross-Si…4.3
- CVE-2025-13364The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox…6.4
- CVE-2025-13365The WP Hallo Welt plugin for WordPress is vulnerable to Cros…6.1
- CVE-2025-13366The Rabbit Hole plugin for WordPress is vulnerable to Cross-…4.3
- CVE-2025-13367The User Registration & Membership – Custom Registration For…6.4
- CVE-2025-13369The Premmerce WooCommerce Customers Manager plugin for WordP…6.1
- CVE-2025-1337A vulnerability was found in Eastnets PaymentSafe 2.5.26.0. …5.1
- CVE-2025-13370The ProjectList plugin for WordPress is vulnerable to time-b…4.9
- CVE-2025-13371The MoneySpace plugin for WordPress is vulnerable to Sensiti…8.6
- CVE-2025-13372An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.…4.3
- CVE-2025-13373Advantech iView versions 5.7.05.7057 and prior do not proper…8.7
Are you affected by CVE-2025-13368?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST