Input validation vulnerability in Elements Plus! 2.16.4

The Elements Plus! plugin for WordPress is at risk for a type of cyber attack called Stored Cross-Site Scripting. This can happen through the plugin’s Image Comparison, HotSpot Plus, and Google Maps widgets in versions 2.16.4 and below. The problem is that the plugin doesn’t properly clean or protect user-submitted information, which allows attackers with certain levels of access to insert their own malicious code into web pages. This code can then run whenever someone visits the infected page.