Xpro Addons — 150+ Widgets for Elementor

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

200 searches this plugin appeared in over the last 90 days, 20 listed. 168 left out as unrelated or noise (years, numbers, stray words). 1 of its tags isn't in the top 24 for their own search.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

Share of active installs on each version of this plugin · 58% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 3 months ago and the previous band took 14 months to cross, so the real count is still just over 40K.

At the current install trend, crossing 50K+ in roughly 123 days.

1. ★★★★★ kpa959993

   1.7y ago

   Why don’t you answer the tickets?Why don’t you answer the email if you don’t see it?What should we, the buyers, do now? This topic was modified 1 year, 4 months ago by kpa959993.

   Read on wp.org ↗
2. ★★★★★ ahnpsc

   1.9y ago

   Rachel was very helpful and sorted my issue quickly.

   Read on wp.org ↗
3. ★★★★★ kimu

   1.9y ago

   I purchased the pro version 1 year ago. I tested it on a website and found so many bugs that I just parked it somewhere never to be touched again. Worse support ever. I opened a support ticket for the first issue I found. The issue was never resolved. I just received circumstantial scripted replies that amounted to nothing. Not surprisingly, there is no way to cancel your subscription from their website, so I had to open a support ticket to get it cancelled. First, they replied by saying that in order to accept my cancellation request I had to submit a feedback. This alone raised all sorts of red flags, because this is a usual tactic that dodgy companies use to delay cancellation requests. After I submitted the feedback they replied “Please rest assured that I’ve processed your cancellation request, and you’ll receive confirmation shortly”. A few days passes, I receive no confirmation, and on my account page on their website my subscription is still active. I write to them again to ask for explanation and they reply, “We sincerely apologize for the inconvenience this has caused. Please rest assured that your subscription has already been canceled as per your request. However, the license key remains active until the date of …, and will automatically deactivate on that date.”That’s right, the key should remain active for the time I have paid for, but the subscription, which is something different than the key is still shown as active, meaning that I am going to be charged on the day of renewal. They offer to “If you’d like us to deactivate the license key immediately, please let us know, and we will take care of it for you.” to which I reply yes, deactivate the key, hoping that this is what is needed to change the status of the subscription and guess what?Nothing has changed. On their website there is no indication of the status of the key, so I cannot say whether has been deactivated, especially because I have not received any confirmation email even for this operation, what a surprise.What I Know for sure, is that the subscription is still active. 10 days have passed with several messages exchanged just for doing something as simple as cancelling a subscription and yet, I have no written or visual confirmation that the subscription has been cancelled. I have blocked them through the bank. Hopefully, this will prevent them from charging with no authorization, but just in case you try XPro, be sure that a chargeback request will be filled. Just stay away from this company and their products.WordPress.org should ban companies like this one.

   Read on wp.org ↗
4. ★★★★★ Anonymous User

   2.0y ago

   The plugin has a bug with its floating effect. The effect only works in the Elementor editor and appears correctly on the frontend immediately after saving content, but it stops working after the first page refresh. This inconsistency disrupts the floating effect’s functionality, impacting the intended visual experience for site visitors. This topic was modified 1 year, 8 months ago by anonymized-23164375.

   Read on wp.org ↗
5. ★★★★★ Tushar Sahu

   2.0y ago

   This is the plugin i have been looking for long time. Free theme Builder is amazing . and it would be cherry on the top if team could add dynamic content visibility support. then we don’t have to look for another plugin . kudos to xpro team

   Read on wp.org ↗
6. ★★★★★ ahmadreza1

   2.3y ago

   I love what this plugin does. It is a gamechanger for addons. Since I am introduced to this, I used on every single site I work on.

   Read on wp.org ↗
7. ★★★★★ AJ20152015

   2.4y ago

   You want a theme builder for Elementor for FREE? XPro is your friend! HIGHLY RECOMMENDED!

   Read on wp.org ↗
8. ★★★★★ Developer

   2.9y ago

   I have been using XPro Elementor Add-on since July 2023 and I am really happy with the kind of creative elements / widgets it supports for Elementor page builder. I have been using this add-on on almost all of my recent websites based on elementor page builder. The best thing is that you don’t even need Elementor Pro; it works even on Free version of Elementor.

   Read on wp.org ↗

All 26 disclosed vulnerabilities are patched in the current version (1.7.11). Sites still on an older version should update.

1. Patched Medium · 4.3 Xpro Addons — 150+ Widgets for Elementor <= 1.7.10 - Cross-Site Request Forgery ↗
   2026-10-22 CVE-2026-114177 Cross-Site Request Forgery Affects <= 1.7.10 Patched in 1.7.11
2. Patched Medium · 6.4 Xpro Elementor Addons <= 1.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2026-09-14 CVE-2026-84088 Improper Neutralization of Input During Web Page Generation Affects <= 1.7.8 Patched in 1.7.9
3. Patched Medium · 5.3 Xpro Addons — 140+ Widgets for Elementor < 1.7.8 - Unauthenticated Information Exposure ↗
   2026-09-02 CVE-2026-84146 Missing Authorization Affects < 1.7.8 Patched in 1.7.8
4. Patched Medium · 6.4 Xpro Elementor Addons <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2026-09-01 CVE-2026-83547 Improper Neutralization of Input During Web Page Generation Affects <= 1.7.3 Patched in 1.7.4
5. Patched Medium · 4.3 Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function ↗
   2026-08-04 CVE-2026-7105 Missing Authorization Affects <= 1.5.1 Patched in 1.5.2
6. Patched Medium · 6.4 Xpro Addons <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets ↗
   2026-06-23 CVE-2026-11614 Improper Neutralization of Input During Web Page Generation Affects <= 1.7.2 Patched in 1.7.3
7. Patched Medium · 5.3 Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation ↗
   2026-05-19 CVE-2025-15369 Missing Authorization Affects <= 1.5.0 Patched in 1.5.1
8. Patched Medium · 6.4 Xpro Addons — 140+ Widgets for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2026-04-03 CVE-2025-13368 Improper Neutralization of Input During Web Page Generation Affects <= 1.4.20 Patched in 1.4.21
9. Patched Medium · 6.4 Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget ↗
   2026-04-03 CVE-2026-2949 Improper Neutralization of Input During Web Page Generation Affects <= 1.4.24 Patched in 1.4.25
10. Patched Medium · 6.5 Xpro Elementor Addons <= 1.5.1 - Authenticated (Contributor+) SQL Injection ↗
    2026-03-30 CVE-2026-45214 Improper Neutralization of Special Elements used in an SQL Command Affects <= 1.5.1 Patched in 1.5.2
11. Patched Medium · 6.4 Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link ↗
    2026-02-26 CVE-2025-14149 Improper Neutralization of Input During Web Page Generation Affects <= 1.4.24 Patched in 1.4.25
12. Patched High · 8.8 Xpro Elementor Addons <= 1.4.19.1 - Authenticated (Author+) Arbitrary File Upload ↗
    2026-01-19 CVE-2025-69312 Unrestricted Upload of File with Dangerous Type Affects <= 1.4.19.1 Patched in 1.4.20
13. Patched Medium · 6.4 Xpro Elementor Addons <= 1.4.19.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-12-06 CVE-2025-63044 Improper Neutralization of Input During Web Page Generation Affects <= 1.4.19.1 Patched in 1.4.20
14. Patched Medium · 6.4 Xpro Elementor Addons <= 1.4.17 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-08-27 CVE-2025-58195 Improper Neutralization of Input During Web Page Generation Affects <= 1.4.17 Patched in 1.4.18
15. Patched Medium · 6.4 Xpro Elementor Addons <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-04-04 CVE-2025-32163 Improper Neutralization of Input During Web Page Generation Affects <= 1.4.10 Patched in 1.4.11
16. Patched Medium · 6.4 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Site Title' widget ↗
    2025-03-19 CVE-2025-2108 Improper Neutralization of Input During Web Page Generation Affects <= 1.4.7.1 Patched in 1.4.8
17. Patched Medium · 6.4 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-03-07 CVE-2024-13649 Improper Neutralization of Input During Web Page Generation Affects <= 1.4.6.7 Patched in 1.4.6.8
18. Patched Medium · 4.3 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.2 - Authenticated (Contributor+) Post Disclosure via Post Duplication ↗
    2025-01-07 CVE-2024-12584 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.4.6.2 Patched in 1.4.6.3
19. Patched Medium · 6.4 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-12-05 CVE-2024-54253 Improper Neutralization of Input During Web Page Generation Affects <= 1.4.6.5 Patched in 1.4.6.6
20. Patched Medium · 4.3 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template ↗
    2024-11-04 CVE-2024-10319 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.4.6 Patched in 1.4.6.1
21. Patched Medium · 6.4 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Grid Widget ↗
    2024-08-26 CVE-2024-7791 Improper Neutralization of Input During Web Page Generation Affects <= 1.4.4.3 Patched in 1.4.4.4
22. Patched Medium · 6.4 Xpro Elementor Addons <= 1.4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-08-07 CVE-2024-43150 Improper Neutralization of Input During Web Page Generation Affects <= 1.4.4.2 Patched in 1.4.4.3
23. Patched High · 8.0 140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection ↗
    2024-05-22 CVE-2024-4471 Deserialization of Untrusted Data Affects <= 1.4.3.1 Patched in 1.4.3.2
24. Patched Medium · 6.4 140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ↗
    2024-05-13 CVE-2024-4440 Improper Neutralization of Input During Web Page Generation Affects <= 1.4.3 Patched in 1.4.3.1
25. Patched Medium · 4.4 140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3 - Authenticated (Admin+) Cross Site Scripting ↗
    2024-05-07 CVE-2024-34570 Improper Neutralization of Input During Web Page Generation Affects <= 1.4.3 Patched in 1.4.3.1
26. Patched Medium · 6.4 130+ Widgets | Best Addons For Elementor – FREE <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-03-28 CVE-2024-2250 Improper Neutralization of Input During Web Page Generation Affects <= 1.4.2 Patched in 1.4.3

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 4 languages, 0 at 90% or more · development strings

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-07-22 30K+ → 40K+ up after 421 days in tier
2. 2025-05-27 20K+ → 30K+ up after 286 days in tier
3. 2024-08-14 10K+ → 20K+ up after 209 days in tier
4. 2024-01-18 9K+ → 10K+ up after 35 days in tier
5. 2023-12-14 8K+ → 9K+ up after 30 days in tier
6. 2023-11-14 7K+ → 8K+ up after 30 days in tier
7. 2023-10-15 6K+ → 7K+ up after 40 days in tier
8. 2023-09-05 5K+ → 6K+ up after 36 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Xpro Addons — 150+ Widgets for Elementor into a readme, a review or a deck. It updates itself.

Xpro Addons — 150+ Widgets for Elementor: 40K+ active installs, 4.4★ (28 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/xpro-elementor-addons