Vulnerabilities > Themesgrove > ALL IN ONE Addons FOR Elementor > 1.0.2

DATE	CVE	VULNERABILITY TITLE	RISK
2023-01-02	CVE-2022-4256	Unspecified vulnerability in Themesgrove All-In-One Addons for Elementor The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) network low complexity themesgrove	4.8
2021-05-05	CVE-2021-24267	Cross-site Scripting vulnerability in Themesgrove All-In-One Addons for Elementor The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method. network themesgrove CWE-79	3.5

CVE is a registered MITRE Corporation trademark and MITRE's CVE website is the authoritative source of CVE content. CWE is a registered MITRE Corporation trademark and MITRE's CWE website is the authoritative source of CWE content.