CVE-2026-2949

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2949", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-21T19:57:32.884Z", "datePublished": "2026-04-04T02:26:21.136Z", "dateUpdated": "2026-04-08T17:12:20.351Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:12:20.351Z"}, "affected": [{"vendor": "xpro", "product": "Xpro Addons \u2014 140+ Widgets for Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.4.24", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Xpro Addons \u2014 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Box widget in versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Xpro Addons \u2014 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a1192c12-a898-46d9-9eee-6f611e644676?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3470049/xpro-elementor-addons"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2026-02-21T20:12:50.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-03T13:35:46.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T15:51:24.088556Z", "id": "CVE-2026-2949", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T15:51:51.927Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2949", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T15:51:24.088556Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T15:51:45.647Z"}}], "cna": {"title": "Xpro Addons \u2014 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "xpro", "product": "Xpro Addons \u2014 140+ Widgets for Elementor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.4.24"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-21T20:12:50.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-03T13:35:46.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a1192c12-a898-46d9-9eee-6f611e644676?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3470049/xpro-elementor-addons"}], "descriptions": [{"lang": "en", "value": "The Xpro Addons \u2014 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Box widget in versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:12:20.351Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2949", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:12:20.351Z", "dateReserved": "2026-02-21T19:57:32.884Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-04T02:26:21.136Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Xpro Addons \u2014 140+ Widgets for Elementor", "vendor": "xpro", "versions": [{"lessThanOrEqual": "1.4.24", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Xpro Addons \u2014 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Box widget in versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Xpro Addons - 140+ Widgets para Elementor para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del widget Icon Box en versiones hasta la 1.4.24, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de nivel de colaborador y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-2949", "lastModified": "2026-07-24T22:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2949", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-06T15:51:24.088556Z", "version": "2.0.3"}}]}, "published": "2026-04-04T04:17:14.723", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3470049/xpro-elementor-addons"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a1192c12-a898-46d9-9eee-6f611e644676?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.4.24]"}}], "enrichment": {"confidence": 94.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 94.0, "source": "matching"}]}, "original": {"product": "Xpro Addons \u2014 140+ Widgets for Elementor", "source": "cna", "vendor": "xpro"}, "product": "xpro_addons_\u2014_140+_widgets_for_elementor", "vendor": "xpro"}], "analysis": {"en": {"generated_at": "2026-04-04T06:20:23.958253+00:00", "value": {"mitigation_remediation": ["Update the Xpro Addons plugin to version 1.4.25 or later, if a patched release is available. If an update cannot be applied, remove or disable the Icon Box widget instances that may contain injected scripts, and delete any pages or content edited by the vulnerable user."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Xpro Addons \u2014 140+ Widgets for Elementor plugin for WordPress, specifically versions up to and including 1.4.24.", "description_and_impact": "The Xpro Addons plugin for Elementor has a stored cross\u2011site scripting flaw in the Icon Box widget. Input supplied by any authenticated user with contributor or higher privileges is stored without proper sanitization or escaping, allowing arbitrary JavaScript to be embedded in the page content. Attackers can use this to execute client\u2011side scripts whenever a victim visits the page, potentially hijacking sessions, defacing content, or executing further malicious actions within the browser context. The weakness is identified as CWE\u201179.", "risk_and_exploitability": "The CVSS score for the vulnerability is 6.4, indicating medium severity. EPSS data and CISA KEV status are unavailable, suggesting that the exploit is not currently listed in known exploited vulnerability catalogs. The attack requires authenticated access with at least contributor rights; an attacker can then inject a payload that will be executed by any user who views the affected page. The impact would be confined to users who view the page, but within that scope, it could compromise confidentiality and integrity of user sessions and the site\u2019s UI. Due to the lack of public exploits and the need for authentication, the immediate risk is moderate, but it is still actionable."}}}}, "created": "2026-04-06T20:27:44.860793+00:00", "updated": "2026-04-06T22:21:03.880806+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "xpro", "xpro$PRODUCT$xpro_addons_\u2014_140+_widgets_for_elementor"]}