The aThemes Addons for Elementor plugin for WordPress contains a stored cross‑site scripting flaw that allows attackers to inject persistent JavaScript into web pages that are rendered for other site visitors. The weakening of input neutralization identified as CWE‑79 means that malicious scripts can be executed when affected content is displayed in a user’s browser.

The vulnerability is present in the aThemes Addons for Elementor plugin provided by Syed Balkhi. All releases through version 1.1.2 are affected. WordPress sites that have installed or are running any of these versions are directly impacted.

The CVSS score of 6.5 indicates moderate risk, while the EPSS < 1% indicates low likelihood of exploitation. It is not listed in the CISA KEV catalog. The vulnerability is a stored XSS; the likely attack vector is via content input fields in the plugin where malicious scripts could be saved and subsequently executed in the browsers of other visitors, though this is inferred from the nature of the flaw rather than explicitly stated in the advisory.