CVE-2025-22646: WordPress aThemes Addons for Elementor plugin <= 1.0.8 - Stored Cross Site Scripting (XSS) vulnerability
Published Mar 27, 2025
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.0.8.
Affected Software
3 affected components
aThemes Addons for Elementor<=1.0.8
WordPress aThemes Addons for Elementor<=1.0.8
aThemes Athemes Addons For Elementor Wordpress<1.0.9
Remediation
Information
Update the WordPress aThemes Addons for Elementor plugin to the latest available version (at least 1.0.9).
Event History
Mar 27, 2025
CVE Published
via MITRE·03:08 PM
Data Sourced
via MITRE·03:08 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-22646?
CVE-2025-22646 is classified as a Stored Cross-Site Scripting (XSS) vulnerability.
2
How do I fix CVE-2025-22646?
To fix CVE-2025-22646, update aThemes Addons for Elementor to version 1.0.9 or later.
3
What versions are affected by CVE-2025-22646?
CVE-2025-22646 affects aThemes Addons for Elementor versions up to and including 1.0.8.
4
What kind of vulnerability is CVE-2025-22646?
CVE-2025-22646 is an improper neutralization of input during web page generation, leading to Stored XSS.
5
Who is impacted by CVE-2025-22646?
Users of aThemes Addons for Elementor versions up to 1.0.8 are impacted by CVE-2025-22646.