Authenticated (contributor+) stored cross-site scripting via video widget

Due to insufficient input sanitization and output escaping on user supplied attributes. this makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

This vulnerability affects the following application versions:

• ElementsKit Elementor Addons and Templates 2.8.0
• ElementsKit Elementor Addons and Templates 2.8.1
• ElementsKit Elementor Addons and Templates 2.8.5
• ElementsKit Elementor Addons and Templates 2.8.6
• ElementsKit Elementor Addons and Templates 2.8.7
• ElementsKit Elementor Addons and Templates 2.8.8
• ElementsKit Elementor Addons and Templates 2.9.0
• ElementsKit Elementor Addons and Templates 2.9.1
• ElementsKit Elementor Addons and Templates 2.9.2
• ElementsKit Elementor Addons and Templates 3.0.0
• ElementsKit Elementor Addons and Templates 3.0.1
• ElementsKit Elementor Addons and Templates 3.0.2
• ElementsKit Elementor Addons and Templates 3.0.3
• ElementsKit Elementor Addons and Templates 3.0.4
• ElementsKit Elementor Addons and Templates 3.0.5
• ElementsKit Elementor Addons and Templates 3.0.6
• ElementsKit Elementor Addons and Templates 3.0.7
• ElementsKit Elementor Addons and Templates 3.1.0
• ElementsKit Elementor Addons and Templates 3.1.1
• ElementsKit Elementor Addons and Templates 3.1.2
• ElementsKit Elementor Addons and Templates 3.1.3
• ElementsKit Elementor Addons and Templates 3.1.4
• ElementsKit Elementor Addons and Templates 3.2.0
• ElementsKit Elementor Addons and Templates 3.2.1
• ElementsKit Elementor Addons and Templates 3.2.2
• ElementsKit Elementor Addons and Templates 3.2.3
• ElementsKit Elementor Addons and Templates 3.2.4
• ElementsKit Elementor Addons and Templates 3.2.5
• ElementsKit Elementor Addons and Templates 3.2.6
• ElementsKit Elementor Addons and Templates 3.2.7