PT-2025-45566 · WordPress+1 · Athemes Addons For Elementor+1

Abu Hurayra · Published 2025-11-08 · Updated 2025-11-08 · CVE-2025-12837

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions aThemes Addons for Elementor plugin for WordPress versions through 1.1.5

Description The aThemes Addons for Elementor plugin for WordPress has a flaw that allows for the injection of malicious web scripts. This is due to inadequate handling of user-provided data within the Call To Action widget. Authenticated attackers with contributor-level permissions or higher can exploit this to insert arbitrary web scripts into pages. These scripts will then execute when any user visits the affected page. The issue stems from insufficient input sanitization and output escaping of user-supplied values.

Recommendations Update aThemes Addons for Elementor plugin for WordPress to a version later than 1.1.5.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-12837

Affected Products

Elementor

Athemes Addons For Elementor

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-12837 · Security Note
• https://wordpress.org/plugins/athemes-addons-for-elementor-lite/#developers · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/75a3a8ee-42c6-4963-bb48-6794b310b861?source=cve · Note
• https://t.me/CVEtracker/36867 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3391638%40athemes-addons-for-elementor-lite&old=3382628%40athemes-addons-for-elementor-lite&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/athemes-addons-for-elementor-lite/tags/1.1.5/inc/modules/widgets/call-to-action/class-call-to-action.php#L938 · Note
• https://t.me/cveNotify/142213 · Telegram Post
• https://twitter.com/CVEnew/status/1987092885637054631 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1987138439704203624 · Twitter Post