CVE-2025-12837

The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in the Call To Action widget. The root cause is insufficient input sanitization and output escaping on user-supplied values, allowing arbitrary scripts to be stored in the widget's settings [1].

To exploit this vulnerability, an attacker must have contributor-level or higher permissions in WordPress. The attacker can inject malicious JavaScript code into the Call To Action widget, which will be stored and executed whenever a user accesses the affected page.

Successful exploitation enables the attacker to execute arbitrary web scripts in the context of the victim's browser. This can lead to session hijacking, website defacement, or redirection to malicious sites, potentially compromising the site and its users.

The vulnerability affects all versions up to and including 1.1.5. Users should update to a patched version as soon as possible. If no patch is available, administrators should restrict contributor access or disable the Call To Action widget temporarily.