TI-2021-06559 Aliases CVE-2021-24267 GHSA-r7g7-rfqf-6fx5

All-in-One Addons for Elementor - WidgetKit < 2.3.10 - Contributor+ Stored XSS

LOW 26CWE-79Published 2021-05-05 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.

Why it matters now

EPSS 0.00663 51st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed All-in-One Addons for Elementor – WidgetKit (Unknown): 2.3.10

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	All-in-One Addons for Elementor – WidgetKit	2.3.10 to before 2.3.10	2.3.10	Patch available	CNA

All-in-One Addons for Elementor – WidgetKit VendorUnknown Affected 2.3.10 to before 2.3.10 Fixed in 2.3.10 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:themesgrove:all-in-one_addons_for_elementor::::::wordpress::*	before 2.3.10	Vulnerable	Themesgrove

cpe:2.3:a:themesgrove:all-in-one_addons_for_elementor:*:*:*:*:*:wordpress:*:* Versions before 2.3.10 Vulnerable ·Themesgrove

Remediation

Fix · CNA All-in-One Addons for Elementor – WidgetKit (Unknown) Fixed in 2.3.10

Timeline

2026-10-02 Threatist record created from CVE-2021-24267
2026-10-03 Alias added: GHSA-r7g7-rfqf-6fx5
2026-10-06 EPSS moved to the 50th–90th percentile

References

Exploit 1

https://wpscan.com/vulnerability/0c96f3a1-d192-481f-9035-5393f4aadc19

Advisory 1

https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/

TI-2022-03897 All-in-One Addons for Elementor - WidgetKit < 2.4.4 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
TI-2024-24932 WordPress All-in-One Addons for Elementor – WidgetKit plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
TI-2025-02046 Cross-site scripting in Themesgrove All-in-One Addons for Elementor – WidgetKit CVSS 3.1MEDIUM 6.4
TI-2024-01987 Cross-site scripting in Themesgrove All-in-One Addons for Elementor – WidgetKit CVSS 3.1MEDIUM 6.4
TI-2024-09562 Information disclosure in Themesgrove All-in-One Addons for Elementor – WidgetKit CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences