CVE-2025-60112

MediumCVSS 6.5

Published: 26/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

The aThemes Addons for Elementor plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 1.1.2.

Risk Assessment

An attacker can inject malicious scripts that are stored and executed in a user's browser when they visit the affected page, potentially leading to session theft or account takeover.

Recommendation

Update the aThemes Addons for Elementor plugin to a version newer than 1.1.2 that includes the fix for this vulnerability.

Other vulnerabilities in aThemes Addons for Elementor

CVE-2025-12837Medium
The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Call To Action widget in versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping on user-supplied values. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.1.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS