What is the CVSS score of CVE-2025-8444?

CVE-2025-8444 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Animation Addons Elementor CVE-2025-8444

EUVD-2025-210103 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-10 security@wordfence.com

GHSA-h556-36wc-hwh6

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 05:31 vuln.today

CVE Published

Jun 10, 2026 - 05:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Animation Addons for Elementor - GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the multiple parameters in all versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

DOM-Based Stored Cross-Site Scripting in the Animation Addons for Elementor WordPress plugin (all versions up to and including 2.6.7) allows authenticated attackers holding Contributor-level access or higher to inject persistent malicious scripts through multiple unsanitized plugin parameters. The injected payload executes in the browsers of any user who subsequently loads an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit identified at time of analysis and the plugin is not listed in the CISA KEV catalog, but the Changed scope (S:C) in the CVSS vector elevates real-world impact beyond the 6.4 score suggests for multi-author WordPress deployments.

Technical ContextAI

The vulnerability is rooted in the plugin's client-side JavaScript asset (wcf-addons.min.js, as identified via the NVD reference to the WordPress Trac browser), which processes Elementor widget parameters and writes them to the DOM without adequate sanitization or output escaping. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) describes the root cause: attacker-controlled data flows from storage into a DOM sink without encoding. Because the XSS variant is DOM-Based, the payload never passes through the server response body - it is injected and executed entirely within the browser's JavaScript runtime, which makes server-side Web Application Firewall rules less effective at detection. The plugin leverages the GreenSock Animation Platform (GSAP) to animate Elementor widgets; multiple animation-related parameters are confirmed affected. No CPE string was supplied in the available intelligence; the affected software is identified by plugin slug and version range only.

RemediationAI

Update the Animation Addons for Elementor plugin to a version beyond 2.6.7 once a patched release is confirmed available - the exact fix version was not provided in the available intelligence and should be verified against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/9d1cb486-f461-4a06-ae9a-39669109b2c0 and the official WordPress plugin repository before upgrading. As a compensating control until a patch is confirmed, restrict or remove Contributor-level role assignments for any untrusted users - this eliminates the PR:L precondition and breaks the attack chain without disabling the plugin. Alternatively, deactivate the Animation Addons for Elementor plugin entirely on sensitive or public-facing sites; note this will remove all GSAP-powered animations from Elementor pages. Implementing a Content Security Policy (CSP) header that restricts inline script execution can reduce exploitability of DOM-Based XSS broadly, though configuration complexity and potential breakage of legitimate plugin JavaScript should be evaluated before deployment.