The WidgetKit plugin allows an authenticated contributor or higher to inject arbitrary scripts into the button+modal widget. The plugin fails to sanitize or escape user supplied attributes, meaning the stored payload will be rendered when any visitor opens a page containing that widget. This is a CWE-79 stored cross-site scripting flaw, enabling attackers to execute malicious code in the visitor's browser, potentially stealing session cookies, defacing the site, or phishing for credentials.

Affected systems are WordPress installations using the All-In-One Addons for Elementor - WidgetKit plugin, specifically versions 2.5.4 and earlier. The issue arises in the button+modal widget across all roles that can edit content but does not affect the underlying WordPress core or other plugins.

The flaw carries a CVSS score of 6.4 and an EPSS of less than 1%, indicating low spontaneous exploitation likelihood, and it is not listed in the CISA KEV catalog. However, because the vector requires contributor-level access, sites with many contributors are at higher risk. An attacker with such permission can inject code that will run for all visitors, enabling credential theft or site defacement.