Dynific Addons for Elementor < 1.3.1 - Author+ Stored XSS via Post Title in Post Image Widget

Description

The plugin does not escape the post title before outputting it in a quoted HTML attribute in one of its Elementor widgets, allowing authenticated users with the Author role to publish a post whose title executes as script in the session of anyone, including an administrator, who views it, resulting in Stored Cross-Site Scripting.