CVE-2025-12837

Name of the Vulnerable Software and Affected Versions aThemes Addons for Elementor plugin for WordPress versions through 1.1.5

Description The aThemes Addons for Elementor plugin for WordPress has a flaw that allows for the injection of malicious web scripts. This is due to inadequate handling of user-provided data within the Call To Action widget. Authenticated attackers with contributor-level permissions or higher can exploit this to insert arbitrary web scripts into pages. These scripts will then execute when any user visits the affected page. The issue stems from insufficient input sanitization and output escaping of user-supplied values.

Recommendations Update aThemes Addons for Elementor plugin for WordPress to a version later than 1.1.5.