EUVD-2026-20404Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
Lifecycle Timeline
3DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wealcoder Animation Addons for Elementor animation-addons-for-elementor allows DOM-Based XSS.This issue affects Animation Addons for Elementor: from n/a through <= 2.6.1.
AnalysisAI
DOM-based cross-site scripting (XSS) in Wealcoder Animation Addons for Elementor through version 2.6.1 allows authenticated attackers with low privileges to inject malicious scripts that execute in users' browsers with the click of a link. The vulnerability stems from improper input neutralization during web page generation and affects all versions of the plugin up to and including 2.6.1. With an EPSS score of 0.03% and no confirmed active exploitation, this represents a lower-priority vulnerability despite the authenticated attack requirement.
Technical ContextAI
Animation Addons for Elementor is a WordPress plugin extending the Elementor page builder with animation capabilities. The vulnerability is classified as DOM-based XSS (CWE-79: Improper Neutralization of Input During Web Page Generation), meaning malicious input is processed and reflected in the DOM without adequate sanitization or encoding. The plugin fails to properly neutralize user-supplied input before inserting it into the HTML or JavaScript context, allowing attackers to break out of intended data contexts and execute arbitrary JavaScript. DOM-based XSS differs from reflected or stored variants in that the malicious payload is processed entirely on the client side by JavaScript code, often making detection by traditional server-side WAF rules ineffective.
RemediationAI
Update Animation Addons for Elementor to a version higher than 2.6.1 immediately. WordPress administrators should navigate to Plugins > Installed Plugins, locate Animation Addons for Elementor, and apply the available update. If an updated version with the fix is available, install it directly via the WordPress plugin update interface. For detailed patch information and verification, consult the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/animation-addons-for-elementor/vulnerability/wordpress-animation-addons-for-elementor-plugin-2-6-1-cross-site-scripting-xss-vulnerability. As a temporary mitigation pending patch deployment, restrict plugin access to trusted administrators only and monitor for suspicious activity in user accounts with plugin editing permissions.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today