Plus Addons for Elementor vulnerabilities

The Plus Addons for Elementor plugin for WordPress up to version 6.4.11 is vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the Button widget's `custom_attributes` setting. The `render` function passes the raw string through `tp_senitize_js_input()`, which is bypassable.

The Plus Addons for Elementor plugin for WordPress up to version 6.4.15 contains a stored XSS vulnerability via the 'carousel_direction' parameter in the Carousel Anything widget. Insufficient output escaping in the render() function allows HTML attribute injection, enabling authenticated attackers (contributor-level and above) to inject arbitrary scripts.

The Plus Addons for Elementor WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author to perform Stored Cross-Site Scripting attacks.