CVE-2021-24267

The WordPress plugin All-in-One Addons for Elementor – WidgetKit (before 2.3.10) contains stored XSS in multiple widgets. Root cause: input parameters such as custom_header_tag and post_header_tag (and similar heading_tag) are not properly filtered/escaped, allowing JavaScript to be saved via a s...