Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

12 records

Vendor: Themesgrove Clear all filters
TI-2025-08031 CVE-2025-8779 · GHSA-7cr7-56vr-qh9g

Cross-site scripting in Themesgrove All-in-One Addons for Elementor – WidgetKit

Priority LOW 28

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Team and Countdown widgets in all versions up to, and including, 2.5.6 due to insufficien…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00216 Published 2025-12-13 No fix listed CWE-79
TI-2025-02046 CVE-2025-2330 · GHSA-fmpv-c99q-rr6r

Cross-site scripting in Themesgrove All-in-One Addons for Elementor – WidgetKit

Priority LOW 28

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+modal' widget in all versions up to, and including, 2.5.4 due to insufficient inp…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00282 Published 2025-07-02 No fix listed CWE-79
TI-2025-03400 CVE-2025-3851 · GHSA-x9pj-x79p-c849

Information disclosure in Themesgrove Download Manager and Payment Form WordPress Plugin…

Priority LOW 20

The Download Manager and Payment Form WordPress Plugin – WP SmartPay plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 1.1.0 to 2.7.13 via the show() function due to missing validation on…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00296 Published 2025-05-07 No fix listed CWE-200
TI-2024-09562 CVE-2024-10321 · GHSA-9jm3-6jrh-6hj7

Information disclosure in Themesgrove All-in-One Addons for Elementor – WidgetKit

Priority LOW 20

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 in elements/advanced-tab/template/view.php.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00312 Published 2025-03-08 No fix listed CWE-200
TI-2024-24932 CVE-2024-37428 · GHSA-967w-jpq9-79vj

WordPress All-in-One Addons for Elementor – WidgetKit plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themesgrove WidgetKit allows Stored XSS.This issue affects WidgetKit: from n/a through 2.5.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00295 Published 2024-07-22 No fix listed CWE-79
TI-2024-22850 CVE-2024-34548 · GHSA-v863-wq9j-pjg4

WordPress All-in-One Addons for Elementor – WidgetKit plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit allows Stored XSS.This issue affects WidgetKit: from n/a through 2.4.8.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00259 Published 2024-05-08 No fix listed CWE-79
TI-2023-19775 CVE-2023-38391 · GHSA-2qp4-x94h-6q6w

WordPress Onepage Builder – Easiest Landing Page Builder For WordPress Plugin <= 2.4.1 is vulnerable to SQL Injection

Priority LOW 35

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themesgrove Onepage Builder allows SQL Injection.This issue affects Onepage Builder: from n/a through 2.4.1.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00681 Published 2023-11-03 No fix listed CWE-89
TI-2022-03897 CVE-2022-4256 · GHSA-mvrw-m229-pjr8

All-in-One Addons for Elementor - WidgetKit < 2.4.4 - Admin+ Stored XSS

Priority MEDIUM 55

The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks eve…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00493 Published 2023-01-02 Fixed in 2.4.4
TI-2021-06559 CVE-2021-24267 · GHSA-r7g7-rfqf-6fx5

All-in-One Addons for Elementor - WidgetKit < 2.3.10 - Contributor+ Stored XSS

Priority LOW 26

The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a simi…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00663 Published 2021-05-05 Fixed in 2.3.10 CWE-79