HTTPS issues

I think this issue is unrelated to our plugin, since it doesn’t alter the way the images are inserted/linked.
Does the issue occur just in widgets or even in post/pages?
Did you switch from HTTP to HTTPS somewehere in time or the site always worked in HTTPS? If you switched, you should have updated all the URLs throughout the site (using the recommended Search & Replace tool).

Not all pages on the site are https, yet the widgets are on all pages. WordPress and all other widgets handle it just fine, but anything in this widget does not change as it should. If it happened elsewhere also I would think it was not related to this plugin, but it seems to only happen in this widget.

Are you using some plugin or custom code to handle a site with mixed HTTP and HTTPS pages? Does the issue occurs even with standard WP text widgets?

An idea for a workaround can be to filter the widget text performing a search/replace on the fly. Something like this (not tested):

function widget_ssl_filter($text) {
  if (is_ssl() ) {
    $text = str_replace('https://', 'https://', $text);
  }
  return $text;
}
add_filter('widget_text', 'widget_ssl_filter');

This may have collateral effects on external links which should not be changed to https, so it may need a to be refined depending on your needs.

I am using iThemes Security to turn on https for specific pages. But, it is only using core functionality of WP instead of manually editing the config file. I do not have problems with other widgets including the text widget. only this plugin. I am not looking for a ‘workaround’, i am looking to get this plugin fixed, so that it works correctly like all the other plugins and WP itself.

I took a look at the code used by the iThemes Security plugin (free version) to handle this. It uses the same logic that I suggested above: a filter with a search/replace on the fly. Anyway it looks like it only has effect on post/page content and not on widgets.
Are you really 100% sure that links inserted in standard WP text widgets do change depending on the page protocol? Could you post a link to your site?

Please try the following: edit the file plugins/better-wp-security/modules/free/ssl/class-itsec-ssl.php and add the following line:

add_filter( 'widget_text', array( $this, 'replace_content_urls' ) );

just after:

add_filter( 'the_content', array( $this, 'replace_content_urls' ) );

If that works, I would ask the iThemes staff to add it it to their codebase. It makes sense that this is made on their side, since it’s generic and works on all widgets that uses the widget_text hook (which is standard).

I will try that and get back to you. I had tested the text widget and a few others and they were getting changed, but I will check again and test this code. I do agree that if that is the case that it should be on their end for the fix.