Xpro Elementor Addons CSRF Vulnerability CVE-2026-114177 Hits v1.7.10 and Earlier

A cross-site request forgery weakness has been identified in the Xpro Elementor Addons plugin. The flaw impacts all installations running version 1.7.10 or earlier, according to the National Vulnerability Database.

What happened

The National Vulnerability Database recorded CVE-2026-114177 as a high-severity issue. The record describes a cross-site request forgery vulnerability within the Xpro Elementor Addons software. This specific weakness is linked to CWE-352 in the Common Weakness Enumeration. The problem exists in the plugin from its initial release through version 1.7.10. No later versions are mentioned as being free of the issue in this record.

Why it matters

Cross-site request forgery allows attackers to trick users into performing unwanted actions. This can lead to unauthorized changes on a website if the user is logged in. Security teams must assess whether their environments use affected versions of this plugin. The high CVSS score indicates significant potential impact on site integrity.

Next steps

• Inventory all WordPress sites using Xpro Elementor Addons.
• Verify the installed version against the affected range.
• Monitor for vendor announcements regarding patches.
• Review recent administrative actions for signs of tampering.

Detection notes

Security operations teams should monitor for anomalous administrative requests from untrusted origins. Check web server logs for POST requests to sensitive endpoints that lack proper anti-forgery tokens. Look for unexpected changes to site configuration or user permissions. Investigate any sudden updates to theme settings or plugin configurations. Review browser console errors for failed validation attempts. Correlate these signals with user session data to identify potential forgery. Ensure logging captures full request headers for forensic analysis.

Background: Cross-site request forgery (CSRF)

Protect your application by enforcing strict same-origin policies, validating custom headers on all mutating requests, and ensuring cookies are marked with secure flags. This checklist provides actionable steps to prevent attackers from tricking users into performing unwanted actions on trusted sites.

Read the full guide: Cross-Site Request Forgery Prevention Checklist for Secure Web Apps

What to do and how to stay safe: Xpro Elementor Addons

• Audit all managed WordPress installations for the presence of Xpro Elementor Addons.
• Confirm the specific version number installed on each affected site.
• Implement strict server-side validation for all state-changing requests.
• Monitor access logs for unusual patterns of administrative activity.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this vulnerability?

The vulnerability is tracked as CVE-2026-114177.

Which versions of Xpro Elementor Addons are affected?

All versions from the initial release through 1.7.10 are affected.

What is the severity rating of this flaw?

The National Vulnerability Database rates it as high severity with a CVSS score of 8.8.