The All‑in‑One Addons for Elementor – WidgetKit plugin allows authenticated users with contributor privileges or higher to inject arbitrary JavaScript into the Team and Countdown widgets. The vulnerability arises from insufficient server‑side input sanitization and output escaping when handling user supplied attributes, enabling a stored XSS payload that executes whenever the affected page is viewed.

All WordPress installations using the WidgetKit plugin version 2.5.6 or earlier are vulnerable; the issue exists in all earlier releases of the plugin on any WordPress site where the Team or Countdown widgets are enabled.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. An attacker must first authenticate to the WordPress site with at least contributor role, then create or edit a page that uses the vulnerable widgets; a successful payload is delivered to any visitor who only needs to load that page.