CVE-2026-8613: aThemes Addons for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget Setting
The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titletag' Widget Setting in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This affects the Posts Timeline widget as well as the Posts Carousel widget across its default, Banner, and Modern skins, all of which omit the whitelist validation that is correctly applied in the Posts List widget.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aThemes Addons for Elementorto a version that resolves this vulnerability.Fixed in 1.1.8 - Configuration
Since the vulnerability is in the 'title_tag' Widget Setting for Posts Timeline and Posts Carousel widgets (default, Banner, Modern skins), update the plugin so these widget settings use the same whitelist validation approach as the Posts List widget to prevent stored XSS.
aThemes Addons for Elementor (Elementor Widgets: Posts Timeline, Posts Carousel; default/Banner/Modern skins) title_tag (Widget Setting) input sanitization/output escaping = Apply proper input sanitization and output escaping (whitelist validation like Posts List widget)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8613?
CVE-2026-8613 has a medium severity rating of 6.4.
How do I fix CVE-2026-8613?
To fix CVE-2026-8613, update the aThemes Addons for Elementor plugin to a version beyond 1.1.8.
Who is affected by CVE-2026-8613?
Authenticated users with Contributor permissions or higher are affected by CVE-2026-8613.
What type of vulnerability is CVE-2026-8613?
CVE-2026-8613 is a Stored Cross-Site Scripting (XSS) vulnerability.
What impact does CVE-2026-8613 have on aThemes Addons for Elementor?
CVE-2026-8613 can allow authenticated attackers to inject malicious scripts via the 'title_tag' Widget Setting.