CVE-2024-2137

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple pricing widgets e.g. Pricing Single, Pricing Icon, Pricing Tab in all versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. Thi...

PT-2025-51093

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Team and Countdown widgets in all versions up to, and including, 2.5.6 due to insufficient input sanitization and output escaping on user supplied attributes. This...

EUVD-2024-27101

Malicious code in bioql PyPI...

EUVD-2024-54128

Malicious code in bioql PyPI...

CVE-2025-2330

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+modal' widget in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2025-2330 All-in-One Addons for Elementor – WidgetKit <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via button+modal Widget

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+modal' widget in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

WordPress WidgetKit plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin WidgetKit versions = 2.5.4...

CVE-2024-10321

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 in elements/advanced-tab/template/view.php. This makes it possible for authenticated attackers, with Contributor-level access and above,...

WordPress WidgetKit Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS)

Software WidgetKit Type Plugin Vulnerable versions = 2.5.0 Fixed in 2.5.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37428 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 351434df7944 Credits 4rCanJ0x! Required privilege Contributor...

WordPress WidgetKit Plugin <= 2.5.1 is vulnerable to Broken Access Control

Software WidgetKit Type Plugin Vulnerable versions = 2.5.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33908 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 38f3250eb362 Credits Dhabaleshwar Das Required privilege...

WordPress All-in-One Addons for Elementor – WidgetKit plugin <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Pricing Widgets vulnerability discovered by Francesco Carlucci in WordPress Plugin WidgetKit versions = 2.5.1...

WordPress WidgetKit plugin <= 2.3.9 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities discovered by WordFence in WordPress WidgetKit plugin versions = 2.3.9. Solution Update the WordPress WidgetKit plugin to the latest available version at least 2.3.10...