The aThemes Addons for Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in its Call To Action widget. Due to inadequate sanitization and escaping of user-supplied input, authenticated users with contributor or higher privileges can inject arbitrary JavaScript code. This code executes in the context of any user viewing the compromised page, potentially leading to session hijacking or other script-based attacks. The issue affects versions up to 1.1.5 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).

An attacker with contributor-level or higher permissions can inject persistent malicious scripts into pages via the vulnerable widget. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content when other users view the infected page. There is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling the vulnerable Call To Action widget. Monitor vendor channels for updates and apply patches promptly once released.