CVE-2025-8779: Improper Neutralization of Input During Web Page Generation

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Team and Countdown widgets in all versions up to, and including, 2.5.6 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2025-2330: Improper Neutralization of Input During Web Page Generation

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+modal' widget in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2024-10321: Exposure of Sensitive Information to an Unauthorized Actor

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 in elements/advanced-tab/template/view.php. This makes it possible for authenticated attackers, with Contributor-level access and above,...

PT-2024-18862

Name of the Vulnerable Software and Affected Versions All-in-One Addons for Elementor – WidgetKit plugin for WordPress versions up to, and including, 2.4.8 Description The issue is related to Stored Cross-Site Scripting via multiple pricing widgets, such as Pricing Single, Pricing Icon, and Prici...

CVE-2024-2137: Improper Neutralization of Input During Web Page Generation

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple pricing widgets e.g. Pricing Single, Pricing Icon, Pricing Tab in all versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2022-4256: Undefined Security Weakness

The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

PT-2021-15807

Name of the Vulnerable Software and Affected Versions All-in-One Addons for Elementor – WidgetKit versions prior to 2.3.10 Description The issue allows lower-privileged users, such as contributors, to perform stored Cross-Site Scripting XSS attacks. This is possible due to several vulnerable...

CVE-2021-24267: Improper Neutralization of Input During Web Page Generation

The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method...