CVE-2025-8779

Name of the Vulnerable Software and Affected Versions All-in-One Addons for Elementor – WidgetKit versions prior to 2.5.7

Description The All-in-One Addons for Elementor – WidgetKit plugin for WordPress has a flaw that allows malicious code to be stored and executed when a user views a page containing the injected code. This impacts the Team and Countdown widgets due to inadequate handling of user-provided data, specifically insufficient input sanitization and output escaping of user-supplied attributes. An attacker with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will then execute in the browsers of users who access the affected pages.

Recommendations Update All-in-One Addons for Elementor – WidgetKit to version 2.5.7 or later.