EUVD-2026-51010
GHSA-74h9-jqh5-9rwq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
PR:L corrects the NVD vector error; upload_files capability (Author role) is explicitly required, ruling out PR:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the upload_files capability (Author and above) to upload files containing malicious JavaScript, leading to Stored Cross-Site Scripting.
AnalysisAI
Stored Cross-Site Scripting in Animation Addons for Elementor WordPress plugin (all versions before 2.7.0) allows authenticated users with the upload_files capability - Author role and above - to upload unsanitized SVG or SVGZ files containing embedded JavaScript. When a victim visits or previews a page rendering the malicious file, the script executes in their browser under the site's origin, potentially enabling session hijacking or privilege escalation to administrator. No active exploitation is confirmed via CISA KEV, but a publicly available proof-of-concept exists and a vendor patch has been released at version 2.7.0.
Technical ContextAI
The vulnerability arises because the plugin extends WordPress's allowed upload MIME types to include SVG and SVGZ formats without applying sanitization or stripping script-bearing elements from those files before storage. SVG is an XML-based image format that natively supports embedded JavaScript via event handlers and script tags; unlike raster images, SVGs are parsed by the browser's XML/HTML engine, making them a vector for stored XSS when served inline or viewed directly. The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant. The affected product is identified via CPE cpe:2.3:a:unknown:animation_addons_for_elementor:*:*:*:*:*:*:*:* covering all versions prior to 2.7.0. This pattern - SVG upload without sanitization - is a well-documented WordPress plugin antipattern that WPScan routinely identifies.
RemediationAI
Upgrade Animation Addons for Elementor to version 2.7.0 or later, which is the vendor-released patch addressing SVG sanitization. The patch is available through the WordPress plugin repository; site administrators should update immediately via the WordPress admin dashboard or WP-CLI (wp plugin update animation-addons-for-elementor). If immediate upgrade is not possible, restrict the upload_files capability to trusted roles only - remove it from the Author role using a capability management plugin - which eliminates the exploitation path without disabling the plugin entirely. Note that revoking upload_files from Authors will prevent them from uploading any media, which may affect site workflows. Alternatively, disabling the SVG/SVGZ upload allowance added by this plugin (if exposed as a setting) is a targeted workaround, but the plugin's own sanitization logic is the authoritative fix. Reference advisory: https://wpscan.com/vulnerability/d5286cc6-c6e4-40e0-bd08-0699fb0c9e82/
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today