CyberRota Analysis
AI-GeneratedThe Xpro Addons plugin for WordPress prior to version 1.7.4 is vulnerable due to improper escaping of widget settings, enabling users with Contributor roles and higher to execute Stored Cross-Site Scripting (XSS) attacks. This vulnerability could lead to unauthorized script execution in the context of other users, potentially compromising site integrity and user data. WordPress site administrators, particularly those using the affected plugin, should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.