CVE-2026-84146: Unknown Xpro Addons — 140+ Widgets For Elementor

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).

Affected products

• Unknown Xpro Addons — 140+ Widgets For Elementor: before 1.7.8 (fixed in 1.7.8)

Published 2026-09-04. Last modified 2026-09-08.