The vulnerability resides in the Countdown widget of the aThemes Addons for Elementor plugin for WordPress. Insufficient input sanitization and output escaping allow an authenticated user with contributor-level or higher privileges to store malicious scripts in the widget’s attributes. When the page containing the widget is viewed, the injected scripts run with the privileges of the viewing user, potentially enabling credential theft, session hijacking, defacement, or further exploitation of the site.

Vendors and products affected are aThemes Addons for Elementor, specifically all releases up to and including version 1.1.2. No other product versions are impacted according to the CNA data.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. However, because the flaw requires contributor or higher access, attackers who have gained such privileges can execute persistent cross‑site scripting. The vulnerability is not currently listed in CISA’s KEV catalog, but its potential for web‑based attacks warrants prompt remediation.