CVE-2025-60112

The aThemes Addons for Elementor plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation [1]. This vulnerability affects all versions up to and including 1.1.2.

Exploitation requires a privileged user to perform an action, such as clicking a malicious link or visiting a crafted page. While user interaction is needed, the vulnerability is known to be used in mass-exploit campaigns targeting thousands of websites regardless of size [1].

An attacker can inject malicious scripts, including redirects, advertisements, and arbitrary HTML payloads. These scripts execute when any visitor accesses the affected website, potentially leading to further compromise of the site or its users [1].

The issue is resolved in version 1.1.3 of the plugin. Users are strongly recommended to update immediately. Patchstack customers can enable automatic updates for vulnerable plugins [1].