WordPress Plugin Vulnerabilities

Animation Addons for Elementor < 2.6.4 - Contributor+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape some of its settings before outputting them back in pages, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Affects Plugins

Plugin icon
animation-addons-for-elementor
Fixed in 2.6.4

References

URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/9b633f24-4818-43cb-89f7-7d6caf84499b

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.5 (medium)

Miscellaneous

Original Researcher
Osvaldo Noe Gonzalez Del Rio (Os) - krei.dev | ogbuilders.io
Verified
No
WPVDB ID
a696f434-51de-45df-8f07-5e6b04efc58c

Timeline

Publicly Published
2026-05-26 (about 4 months ago)
Added
2026-07-27 (about 2 months ago)
Last Updated
2026-07-27 (about 2 months ago)

Other

Published
Title
Published
2023-11-06
Title
Woocommerce Vietnam Checkout < 2.0.6 - Unauthenticated Stored XSS
Published
2024-04-30
Title
EventON < 2.2.15 - Admin+ Stored XSS
Published
2026-09-03
Title
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment < 2.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-04-22
Title
Accessibility Widget < 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-03-20
Title
WordPress Amazon S3 Plugin < 1.6 - Reflected XSS