CVE-2026-84146

MediumCVSS 5.3/10Last modified Sep 8, 2026

Description

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
UnknownXpro Addons — 140+ Widgets for Elementor< 1.7.8

References

Timeline

Published
Sep 4, 2026
Last modified
Sep 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-8414710.0This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint.CVE-2026-841489.2This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticateCVE-2026-841499.2This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unautCVE-2026-84158.8Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder. TCVE-2026-841505.4The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target userCVE-2026-841513.5The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies itCVE-2026-841536.3A vulnerability was determined in Xinhu Rainrock RockOA up to 2.3.2. The impacted element is the function toaddval of the file /index.php?m=CVE-2026-841549.9A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026xCVE-2026-841555.3CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one API worker process (theCVE-2026-84168.8Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id). CVE-2026-841614.9When an operator enables store.analysis_statistics_dir, a network client with PRODUCT_STORE permission for a product can call that product'sCVE-2026-841640.0The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate puts the report message,