CVE-2024-13808

HIGH 8.8 CVSS 3.1

Published: April 26, 2025
Last modified: June 17, 2026
NVD status: Analyzed
Reported by: security@wordfence.com
Weakness: CWE-94
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.9 via the custom PHP widget. This is due to their only being client side controls when determining who can access the widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Affected products and versions

WPXpro Xpro Elementor Addons - Pro — Up to and including 1.4.9
wpxpro xpro_addons_for_elementor — Before 1.4.10

References

elementor.wpxpro.com https://elementor.wpxpro.com Product
www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/0833e55f-22aa-44c9-aff6-1f3b74016e4c?source=cve Third Party Advisory
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References