Input validation vulnerability in All-in-One Addons for Elementor – WidgetKit 2.4.3

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress has a security vulnerability that puts websites using it at risk. The vulnerability is called Stored Cross-Site Scripting and exists in the plugin’s settings in versions up to 2.4.3. This vulnerability allows attackers who have administrator-level permissions to inject malicious web scripts into pages on the website. This only affects websites that have multiple sites or have disabled a security feature called ‘unfiltered_html’.