CVE-2025-60112: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in aThemes Addons for Elementor plugin affecting versions through 1.1.3. The vulnerability was identified on September 26, 2025, and was assigned CVE-2025-60112. The issue specifically affects the WordPress plugin developed by Syed Balkhi, allowing authenticated users with Contributor-level access or higher to perform stored XSS attacks (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 score of 6.5 (Medium). The attack vector is characterized by CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating that it requires network access, low attack complexity, low privileges, and user interaction (Patchstack).

The vulnerability allows malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts are executed when visitors access the affected site, potentially compromising the security and integrity of the website and its users (Patchstack).

The vulnerability has been patched in version 1.1.3 of the aThemes Addons for Elementor plugin. Users are advised to update to version 1.1.3 or later to remove the vulnerability. The security issue has been classified as having a low severity impact and is considered unlikely to be exploited (Patchstack).