Stored Cross-Site Scripting in Xpro Addons Plugin for WordPress

CVE-2025-13368

What is CVE-2025-13368?

The Xpro Addons plugin for WordPress, which enhances Elementor's functionality with over 140 widgets, is compromised by a stored cross-site scripting vulnerability. This issue arises from inadequate input sanitization and output escaping in the Pricing Widget's 'onClick Event' setting. Authenticated users with contributor level access and higher can exploit this flaw to inject malicious web scripts. These scripts execute when other users access the compromised pages, potentially leading to data theft, session hijacking, or other malicious activities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References