CVE-2021-24266

The Plus Addons for Elementor plugin before version 2.0.6 contains stored XSS vulnerabilities in four widgets that allow lower-privileged users, including contributors, to inject malicious scripts. The Accordion, Infobox, Heading animation, and Hovercard widgets each accept HTML tag parameters (title_html_tag, title_tag, ani_title_tag, and open_tag respectively) that fail to sanitize or escape user input, permitting JavaScript injection through save_builder requests. When affected pages are viewed or previewed, the injected scripts execute in the browser of any visitor. The vulnerability affects versions prior to 2.0.6.

Based on public CVE data (MITRE/NVD).