[Security] Missing output escaping in Elementor widget render() and content_template()

[numbers-official]

Description

The WordPress Elementor widget in plugins/wordpress/capture-eye/includes/elementor-image-widget.php outputs user-controlled values without proper escaping in both the PHP render() method and the Backbone content_template() method.

PHP render() method (lines 234-260)

Multiple attributes are echoed without esc_attr():

nid="<?php echo $nid; ?>"                                    // line 235
layout="<?php echo $settings['capture_eye_layout']; ?>"       // line 236
visibility="<?php echo $settings['capture_eye_visibility']; ?>"  // line 237
eng-img="<?php echo $settings['eng_img']['url']; ?>"          // line 239
eng-link="<?php echo $settings['eng_link']['url']; ?>"        // line 242
action-button-text="<?php echo $settings['action_button_text']; ?>"  // line 245
action-button-link="<?php echo $action_url; ?>"               // line 258

Backbone content_template() method (lines 294-318)

The editor preview template uses unescaped Backbone interpolation:

nid="{{ nid }}"                                    // line 295
layout="{{ settings.capture_eye_layout }}"          // line 296
action-button-text="{{ settings.action_button_text }}"  // line 305
action-button-link="{{ action_url }}"               // line 317

Impact

• Severity: HIGH
• An attacker with WordPress admin access (or via stored settings injection) could break out of HTML attributes and inject event handlers
• Attack vector: action_button_text set to test" onclick="alert(document.cookie) renders as action-button-text="test" onclick="alert(document.cookie)"
• The editor preview (content_template) is also vulnerable, meaning XSS can execute in the Elementor editor context

Suggested Fix

PHP render() method — wrap all attribute outputs:

nid="<?php echo esc_attr( $nid ); ?>"
layout="<?php echo esc_attr( $settings['capture_eye_layout'] ); ?>"
visibility="<?php echo esc_attr( $settings['capture_eye_visibility'] ); ?>"

For URL attributes, use esc_url():

eng-img="<?php echo esc_url( $settings['eng_img']['url'] ); ?>"
eng-link="<?php echo esc_url( $settings['eng_link']['url'] ); ?>"
action-button-link="<?php echo esc_url( $action_url ); ?>"

Backbone content_template() method — sanitize values before interpolation or use Underscore's _.escape().

Related

• Issue [Security] XSS vulnerability in WordPress Elementor widget due to unescaped output #64 identified the XSS vector in the render path; this issue extends coverage to ALL unescaped outputs including the Backbone editor preview template