All-in-One Addons for Elementor

Software Type	Plugin
Software Slug	widgetkit-for-elementor (view on wordpress.org)
Software Status	Active
Software Author	shamsbd71
Software Website	themesgrove.com
Software Downloads	568,913
Software Active Installs	8,000
Software Record Last Updated	July 13, 2026

10 Vulnerabilities

Submit a Vulnerability

All-in-One Addons for Elementor – WidgetKit <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team and Countdown Widgets

6.4

CVE-2025-8779

Dec 12, 2025

Researcher: zer0gh0st

All-in-One Addons for Elementor – WidgetKit <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via button+modal Widget

6.4

CVE-2025-2330

Jul 1, 2025

Researcher: Webbernaut

WidgetKit <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2025-49074

May 30, 2025

Researcher: João Pedro Soares de Alcântara

All-in-One Addons for Elementor – WidgetKit <= 2.5.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates

4.3

CVE-2024-10321

Mar 7, 2025

Researcher: Ankit Patel

WidgetKit <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-37428

Jun 28, 2024

Researcher: João G. Barbosa (4rCanJ0x!)

All-in-One Addons for Elementor – WidgetKit <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-34548

May 7, 2024

Researcher: Ray Wilson

WidgetKit <= 2.5.4 - Missing Authorization to Notice Dismissal

5.3

CVE-2024-33908

Apr 29, 2024

Researcher: Dhabaleshwar Das

All-in-One Addons for Elementor – WidgetKit <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Widgets

6.4

CVE-2024-2137

Apr 11, 2024

Researcher: Francesco Carlucci

All-in-One Addons for Elementor - WidgetKit <= 2.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

5.5

CVE-2022-4256

Dec 6, 2022

Researcher: iohex

All-in-One Addons for Elementor - WidgetKit <= 2.3.9 - Contributor+ Stored Cross-Site Scripting

6.4

CVE-2021-24267

Apr 13, 2021

Researcher: Ram

Title	Status	CVE ID	CVSS	Researchers	Date
All-in-One Addons for Elementor – WidgetKit <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team and Countdown Widgets	Patched	CVE-2025-8779	6.4	zer0gh0st	December 12, 2025
All-in-One Addons for Elementor – WidgetKit <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via button+modal Widget	Patched	CVE-2025-2330	6.4	Webbernaut	July 1, 2025
WidgetKit <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2025-49074	6.4	João Pedro Soares de Alcântara	May 30, 2025
All-in-One Addons for Elementor – WidgetKit <= 2.5.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates	Unpatched	CVE-2024-10321	4.3	Ankit Patel	March 7, 2025
WidgetKit <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2024-37428	6.4	João G. Barbosa (4rCanJ0x!)	June 28, 2024
All-in-One Addons for Elementor – WidgetKit <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2024-34548	6.4	Ray Wilson	May 7, 2024
WidgetKit <= 2.5.4 - Missing Authorization to Notice Dismissal	Patched	CVE-2024-33908	5.3	Dhabaleshwar Das	April 29, 2024
All-in-One Addons for Elementor – WidgetKit <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Widgets	Unpatched	CVE-2024-2137	6.4	Francesco Carlucci	April 11, 2024
All-in-One Addons for Elementor - WidgetKit <= 2.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting	Patched	CVE-2022-4256	5.5	iohex	December 6, 2022
All-in-One Addons for Elementor - WidgetKit <= 2.3.9 - Contributor+ Stored Cross-Site Scripting	Patched	CVE-2021-24267	6.4	Ram	April 13, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation