CVE-2026-8613

Name of the Vulnerable Software and Affected Versions aThemes Addons for Elementor versions prior to 1.1.9

Description The plugin is subject to Stored Cross-Site Scripting, a flaw where malicious scripts are permanently stored on the target server. This occurs due to insufficient input sanitization and output escaping within the title tag widget setting. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user visits the affected page. The issue specifically impacts the Posts Timeline widget and the Posts Carousel widget (including its default, Banner, and Modern skins), as these components lack the whitelist validation used in the Posts List widget.

Recommendations Update to a version later than 1.1.8.