CVE-2026-84088
Last modified
CVE-2026-84088 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Xpro Addons — 140+ Widgets for Elementor | < 1.7.9 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-84088?
How severe is CVE-2026-84088?
How do I fix CVE-2026-84088?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-84081IBM Guardium Data Protection 12.2 could allow a remote attac…8.1
- CVE-2026-84082IBM Guardium Data Protection 12.2 could allow a remote attac…9.8
- CVE-2026-84083IBM Guardium Data Protection 12.2 is vulnerable to local pri…7.8
- CVE-2026-84084IBM Guardium Data Protection 12.2 could allow a remote attac…8.8
- CVE-2026-84085IBM Guardium Data Protection 12.2 could allow a remote attac…8.1
- CVE-2026-84086IBM Guardium Data Protection 12.2 could allow a remote authe…7.2
- CVE-2026-84089IBM Guardium Data Protection 12.2 could allow a local attack…7.8
- CVE-2026-8409Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Requ…8.8
- CVE-2026-84099The wpstorecart WordPress plugin through 5.0.7 does not prev…8.1
- CVE-2026-8410Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Requ…8.8
- CVE-2026-84105IBM Guardium Data Protection 12.2 could allow a remote authe…7.7
- CVE-2026-84106IBM Guardium Data Protection 12.2 could allow a remote authe…8.9
Are you affected by CVE-2026-84088?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST