CVE-2025-12837: aThemes Addons for Elementor XSS Flaw

CVE-2025-12837 Overview

CVE-2025-12837 is a Stored Cross-Site Scripting (XSS) vulnerability in the aThemes Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 1.1.5. It resides in the Call To Action widget, which fails to properly sanitize input and escape output on user-supplied values.

Authenticated attackers with contributor-level or higher permissions can inject arbitrary JavaScript into pages. The malicious payload executes in the browser of any user who visits the affected page, enabling session theft, redirection, or account takeover of higher-privileged users.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against site visitors and administrators, enabling session hijacking and privilege escalation.

Affected Products

aThemes Addons for Elementor (Lite) — versions ≤ 1.1.5
WordPress installations using the plugin's Call To Action widget
Sites permitting contributor-level or higher user registration

Discovery Timeline

2025-11-08 - CVE-2025-12837 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12837

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting (XSS) issue classified as [CWE-79]. It exists in the class-call-to-action.php file of the plugin's Call To Action widget module. The widget accepts user-controlled input for rendering call-to-action content but does not apply adequate sanitization on save or escaping on render.

Because the injected payload is persisted in the database and served to every visitor of the affected page, the attack scope is cross-user. An attacker with contributor privileges can target editors and administrators, leveraging their higher permissions to escalate access, create backdoor accounts, or exfiltrate sensitive data from the WordPress admin interface.

Root Cause

The root cause is insufficient input sanitization and missing output escaping on widget attribute fields. Standard WordPress helpers such as wp_kses_post() for input filtering and esc_attr() or esc_html() for output rendering were not applied consistently to user-supplied values within the widget's render logic.

Attack Vector

Exploitation requires an authenticated session with contributor-level access or above. The attacker uses the Elementor editor to configure a Call To Action widget and supplies a crafted payload containing JavaScript within an affected field. Once the page is saved and later viewed, the script executes in the visitor's browser under the site's origin.

No user interaction beyond visiting the injected page is required. See the WordPress Plugin Class File for the affected source location and the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-12837

Indicators of Compromise

Unexpected <script> tags, event handlers (onerror, onload), or javascript: URIs stored in wp_postmeta entries associated with Elementor data.
Newly created administrator accounts or role changes shortly after a contributor edited a page containing a Call To Action widget.
Outbound requests from visitor browsers to unfamiliar domains originating from pages that render the vulnerable widget.

Detection Strategies

Query the WordPress database for Elementor widget payloads containing suspicious HTML or script fragments, particularly within Call To Action widget attributes.
Review the plugin version across all managed WordPress sites and flag any instance at or below 1.1.5.
Audit contributor and author activity logs for unusual page edits or widget modifications preceding administrative changes.

Monitoring Recommendations

Enable a web application firewall (WAF) with rules that inspect POST bodies to admin-ajax.php and Elementor save endpoints for script payloads.
Log and alert on Content Security Policy (CSP) violations from front-end pages to surface injected scripts in real time.
Monitor lower-privileged user accounts (contributor, author) for anomalous editing behavior against pages that render the Call To Action widget.

How to Mitigate CVE-2025-12837

Immediate Actions Required

Update the aThemes Addons for Elementor Lite plugin to the latest version above 1.1.5 on all WordPress installations.
Audit existing pages that use the Call To Action widget and remove any unexpected script content from widget fields.
Review contributor and author accounts, disabling any that are unused or unrecognized.

Patch Information

A fix for the vulnerability was committed to the plugin repository. Review the WordPress Plugin Changeset for the specific code changes applied, and obtain the patched release via the WordPress Plugin Developer Information page.

Workarounds

Restrict contributor and author role assignments to trusted users only until patching is complete.
Deploy a WAF ruleset that blocks HTML and script tags in requests to Elementor widget save endpoints.
Temporarily disable the aThemes Addons for Elementor plugin if it is not actively required for site functionality.

bash

# Update the plugin from the command line using WP-CLI
wp plugin update athemes-addons-for-elementor-lite

# Verify the installed version is greater than 1.1.5
wp plugin get athemes-addons-for-elementor-lite --field=version