Widgetkit For Elementor Vulnerabilities

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Team and Countdown widgets in all versions up to, and including, 2.5.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for aut...

CVSS:

6.4

Affected:

up to 2.5.6

Fixed in:

2.5.7

Disclosed:

Dec 12, 2025

CVE-2025-8779 on NVD →

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+modal' widget in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenti...

CVSS:

6.4

Affected:

up to 2.5.4

Fixed in:

2.5.5

Disclosed:

Jul 1, 2025

CVE-2025-2330 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemesGrove WidgetKit allows Stored XSS.This issue affects WidgetKit: from n/a through 2.5.4.

Affected:

up to 2.5.5

Fixed in:

2.5.5

Disclosed:

Jun 6, 2025

CVE-2025-49074 on NVD →

The WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that w...

CVSS:

6.4

Affected:

up to 2.5.4

Fixed in:

2.5.5

Disclosed:

May 30, 2025

CVE-2025-49074 on NVD →

[en] The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.4 in elements/advanced-tab/template/view.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensit...

Affected:

up to 2.5.4

Fix:

No patched version reported

Disclosed:

Mar 8, 2025

CVE-2024-10321 on NVD →

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 in elements/advanced-tab/template/view.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive p...

CVSS:

4.3

Affected:

up to 2.5.5

Fix:

No patched version reported

Disclosed:

Mar 7, 2025

CVE-2024-10321 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themesgrove WidgetKit allows Stored XSS.This issue affects WidgetKit: from n/a through 2.5.0.

Affected:

up to 2.5.1

Fixed in:

2.5.1

Disclosed:

Jul 22, 2024

CVE-2024-37428 on NVD →

The WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that w...

CVSS:

6.4

Affected:

up to 2.5.0

Fixed in:

2.5.1

Disclosed:

Jun 28, 2024

CVE-2024-37428 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit allows Stored XSS.This issue affects WidgetKit: from n/a through 2.4.8.

Affected:

up to 2.5.0

Fixed in:

2.5.0

Disclosed:

May 8, 2024

CVE-2024-34548 on NVD →

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level...

CVSS:

6.4

Affected:

up to 2.4.8

Fixed in:

2.5.0

Disclosed:

May 7, 2024

CVE-2024-34548 on NVD →

[en] Missing Authorization vulnerability in Themesgrove WidgetKit.This issue affects WidgetKit: from n/a through 2.5.0.

Affected:

up to 2.5.5

Fixed in:

2.5.5

Disclosed:

May 6, 2024

CVE-2024-33908 on NVD →

The WidgetKit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wk_td_ads_dismiss_notice() function in versions up to, and including, 2.5.4. This makes it possible for unauthenticated attackers to dismiss notices.

CVSS:

5.3

Affected:

up to 2.5.4

Fixed in:

2.5.5

Disclosed:

Apr 29, 2024

CVE-2024-33908 on NVD →

[en] The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple pricing widgets (e.g. Pricing Single, Pricing Icon, Pricing Tab) in all versions up to, and including, 2.4.8 due to insufficient input sanitization and output escaping. This makes it possi...

Affected:

up to 2.5.1

Fix:

No patched version reported

Disclosed:

Apr 12, 2024

CVE-2024-2137 on NVD →

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple pricing widgets (e.g. Pricing Single, Pricing Icon, Pricing Tab) in all versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVSS:

6.4

Affected:

up to 2.5.1

Fix:

No patched version reported

Disclosed:

Apr 11, 2024

CVE-2024-2137 on NVD →

[en] The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected:

up to 2.4.4

Fixed in:

2.4.4

Disclosed:

Jan 2, 2023

CVE-2022-4256 on NVD →

The All-in-One Addons for Elementor - WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings in versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level per...

CVSS:

5.5

Affected:

up to 2.4.3

Fixed in:

2.4.4

Disclosed:

Dec 6, 2022

CVE-2022-4256 on NVD →

[en] The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.

Affected:

up to 2.3.10

Fixed in:

2.3.10

Disclosed:

May 5, 2021

CVE-2021-24267 on NVD →

The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.

CVSS:

6.4

Affected:

up to 2.3.10

Fixed in:

2.3.10

Disclosed:

Apr 13, 2021

CVE-2021-24267 on NVD →

Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered by WordFence in WordPress WidgetKit plugin (versions <= 2.3.9).

Affected:

up to 2.3.10

Fixed in:

2.3.10

Disclosed:

Apr 13, 2021

Affected:

up to 2.5.5

Fixed in:

2.5.5

CVE-2025-2330 on NVD →