CVE-2026-84088

Medium CVSS 6.8

Published 2026-09-16 · last changed 2026-09-17

The fix

We hold no Microsoft remediation data for CVE-2026-84088, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.

Sources

NVD record for CVE-2026-84088

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H