The aThemes Addons for Elementor plugin suffers from insufficient sanitization and escaping in its Call To Action widget, leading to stored Cross‑Site Scripting. An authenticated contributor or higher can embed malicious scripts in widget content that will run in the browsers of any visitor to the affected page, potentially enabling session hijacking, defacement, or data theft.

All WordPress sites running aThemes Addons for Elementor version 1.1.5 or earlier are affected. No specific hardware or OS requirements are mentioned; the flaw exists purely in the plugin’s PHP code that renders widget output.

The CVSS score of 6.4 classifies the issue as a medium‑severity vulnerability. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid contributor‑level credentials and user interaction with the vulnerable widget, making it more limited compared to publicly exploitable flaws.