CVE-2026-83547
Last modified
CVE-2026-83547 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks..
Description
The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Xpro Addons | >= 1.6.0, < 1.7.4 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-83547?
How severe is CVE-2026-83547?
How do I fix CVE-2026-83547?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-8350Concrete CMS 9.5.0 and below is vulnerable to missing author…8.8
- CVE-2026-8351The RTMKit plugin for WordPress is vulnerable to Stored Cros…6.4
- CVE-2026-8352Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
- CVE-2026-83524A security vulnerability has been detected in RedPort Optimi…9.9
- CVE-2026-8353Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XS…4.8
- CVE-2026-83533The WP Express Checkout WordPress plugin before 2.4.9 does n…5.3
- CVE-2026-83548A Pre-authentication SSRF vulnerability exists in the SMA100…10
- CVE-2026-83549Post-authentication Improper Neutralization of Special Eleme…7.8
- CVE-2026-83551Cleartext storage of sensitive information in the @step and …7.2
- CVE-2026-83557DefaultBaseTypeLimitingValidator is the PolymorphicTypeValid…5.6
- CVE-2026-8356LibreOffice can import presentations in the legacy binary PP…5.4
- CVE-2026-83562Contributor Cross Site Scripting (XSS) in WCFM Marketplace <…6.5
Are you affected by CVE-2026-83547?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST