See how many widgets are not escaping properly.

escape-widgets-test.php

<?php
add_filter( 'widget_display_callback', 'exploit_widget_display_callback', 10, 3 );
function exploit_widget_display_callback( $instance, $widget_obj, $args ) {
	foreach( $instance as $k => $v )
		$instance[ $k ] .= '<script>alert("'.esc_js( $widget_obj->name ."  \n". $widget_obj->id ) .'");</script>';
	return $instance;
}