The security hole in the Plus Addons for Elementor plugin was used in active zero-day attacks prior to a patch being issued.
Source: Threadpost