What is the CVSS score of CVE-2026-15299?

CVE-2026-15299 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Animation Addons for Elementor CVE-2026-15299

EUVD-2026-42806 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-10 security@wordfence.com

GHSA-wrxq-46vv-55c2

PHP WordPress XSS

6.4

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS payload execution requires a victim to visit the page (UI:R); PR:L reflects mandatory Contributor authentication; S:C captures cross-browser scope change.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 06:01 vuln.today

CVE Published

Jul 10, 2026 - 05:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'weather_style' and 'move_direction' parameters of the Weather widget in all versions up to, and including, 2.6.3. This is due to insufficient output escaping in the Weather widget's render() function at widgets/weather.php:1246, where both settings values are placed into an HTML class attribute without esc_attr(). Elementor does not server-side validate widget SELECT control values against allowed options on save, so an authenticated attacker with Contributor-level access or above can submit a crafted save_builder AJAX request storing arbitrary values in the _elementor_data post meta. The stored payload renders unescaped on every frontend visit to the affected page (the Weather widget requires an OpenWeatherMap API key to reach the vulnerable output, which is the normal operational state for sites using this widget).

AnalysisAI

Stored Cross-Site Scripting in the Animation Addons for Elementor WordPress plugin (all versions through 2.6.3) enables authenticated attackers with Contributor-level access to permanently inject arbitrary JavaScript into pages using the Weather widget. The payload renders unescaped for every subsequent visitor, enabling session hijacking, credential theft, or admin-context privilege escalation without further attacker interaction. No CISA KEV listing and no public exploit code have been identified at time of analysis, but the low attack complexity combined with scope change to victims' browsers makes this a credible risk for multi-author WordPress deployments running this plugin with the Weather widget actively configured.

Technical ContextAI

The vulnerability exists within the Animation Addons for Elementor WordPress plugin's Weather widget, specifically in the render() function at widgets/weather.php:1246. The root cause (CWE-79) is a missing call to WordPress's esc_attr() function before the weather_style and move_direction settings values are interpolated directly into an HTML class attribute in the rendered output. Elementor's widget framework presents these controls as SELECT dropdowns in the page builder UI, but critically does not perform server-side validation of submitted values against the allowed option set during the save_builder AJAX action. This architectural gap in Elementor's data handling allows a contributor-level user to bypass the client-side UI constraint entirely by crafting a raw AJAX POST request with arbitrary parameter values. Those values are then persisted to the _elementor_data post meta field and echoed verbatim on every frontend page load. The Weather widget's vulnerable code path is reached only when an OpenWeatherMap API key is configured, which is the standard operational state for any site actually using the widget's core functionality.

RemediationAI

Update Animation Addons for Elementor to version 2.6.4 or later, which applies proper output escaping (esc_attr()) to the weather_style and move_direction parameters in the Weather widget's render() function; the exact changeset is available at https://plugins.trac.wordpress.org/changeset?old_path=/animation-addons-for-elementor/tags/2.6.3&new_path=/animation-addons-for-elementor/tags/2.6.4. If an immediate update is not feasible, a targeted compensating control is to revoke Contributor-level (and above) access for any untrusted users on affected WordPress sites, preventing submission of crafted save_builder AJAX requests - note this disrupts legitimate content workflows and is not a permanent fix. Alternatively, removing the Weather widget from all published pages eliminates the vulnerable render path entirely while the plugin remains active, though injected payloads already stored in _elementor_data post meta should be audited and cleared. Sites that have not configured an OpenWeatherMap API key in the Weather widget settings do not reach the vulnerable output in normal operation, providing partial de facto protection, but this should not substitute for patching since the payload can still be stored in anticipation of future API key configuration.