{"id":"CVE-2026-114177","kind":"vulnerability","aliases":["CVE-2026-114177"],"related":[],"title":"Xpro Elementor Addons WordPress plugin: CSRF lets attackers act as admins","description":"Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue affects Xpro Elementor Addons: from n/a through 1.7.10.","summary":"The Xpro Elementor Addons WordPress plugin, versions through 1.7.10, has a cross-site request forgery flaw. A logged-in site admin who opens a malicious page could be tricked into making changes to the site without knowing.","severity":"high","cvss":8.8,"epss":0.00133,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","wordpress","xpro-elementor-addons"],"not_affected_if":["plugin-not-installed","version-1.7.11-or-later"],"how_to_check":"Check the installed plugin version in WordPress admin under Plugins, or run wp plugin get xpro-elementor-addons --field=version","fix":"Update xpro-elementor-addons to a version later than 1.7.10; the patched version number is unknown from the sources.","status":"open","published_at":"2026-10-22T07:16:41+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:32:36+00:00","updated_at":"2026-10-24T07:15:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:32:36Z","model":"claude-haiku-5-5","output":{"fix":"Update xpro-elementor-addons to a version later than 1.7.10; the patched version number is unknown from the sources.","reach":"internet","title":"Xpro Elementor Addons WordPress plugin: CSRF lets attackers act as admins","impact":"medium","summary":"The Xpro Elementor Addons WordPress plugin, versions through 1.7.10, has a cross-site request forgery flaw. A logged-in site admin who opens a malicious page could be tricked into making changes to the site without knowing.","category":"package","who_cares":["wordpress","elementor","xpro-elementor-addons"],"confidence":0.6,"needs_auth":"yes","worst_case":"Logged-in admin is tricked into changing site settings or content","analyst_note":"Find the first fixed version and the specific vulnerable actions at the NVD entry or the Wordfence/plugin changelog.","how_to_check":"Check the installed plugin version in WordPress admin under Plugins, or run wp plugin get xpro-elementor-addons --field=version","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-1.7.11-or-later"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00051,"input_tokens":2940,"output_tokens":432,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114177':14A,17A '-2026':13A,16A '1.7.10':33B,93C 'act':9A 'addon':3A,24B,28B,75C,79C,89C 'admin':11A,47B 'affect':86C 'allow':80C 'attack':8A 'chang':58B 'could':53B 'cross':37B,65C,81C 'cross-sit':36B,64C 'csrf':6A,69C 'cve':12A,15A 'elementor':2A,18B,23B,27B,74C,78C,88C 'flaw':41B 'forgeri':40B,68C 'forgery.this':84C 'issu':85C 'know':63B 'let':7A 'log':44B 'logged-in':43B 'make':57B 'malici':51B 'n/a':91C 'open':49B 'packag':19B 'page':52B 'plugin':5A,30B 'request':39B,67C,83C 'site':38B,46B,61B,66C,82C 'trick':55B 'version':31B 'vulner':70C 'without':62B 'wordpress':4A,20B,29B 'xpro':1A,22B,26B,72C,73C,77C,87C 'xpro-elementor-addon':21B,76C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T07:16:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114177","severity":null,"published_at":"2026-10-22T07:16:41+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114177","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114177","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}