Animation Addons For Elementor
Monthly
Stored Cross-Site Scripting in Animation Addons for Elementor WordPress plugin (all versions before 2.7.0) allows authenticated users with the upload_files capability - Author role and above - to upload unsanitized SVG or SVGZ files containing embedded JavaScript. When a victim visits or previews a page rendering the malicious file, the script executes in their browser under the site's origin, potentially enabling session hijacking or privilege escalation to administrator. No active exploitation is confirmed via CISA KEV, but a publicly available proof-of-concept exists and a vendor patch has been released at version 2.7.0.
DOM-based cross-site scripting (XSS) in Wealcoder Animation Addons for Elementor through version 2.6.1 allows authenticated attackers with low privileges to inject malicious scripts that execute in users' browsers with the click of a link. The vulnerability stems from improper input neutralization during web page generation and affects all versions of the plugin up to and including 2.6.1. With an EPSS score of 0.03% and no confirmed active exploitation, this represents a lower-priority vulnerability despite the authenticated attack requirement.
Stored Cross-Site Scripting in Animation Addons for Elementor WordPress plugin (all versions before 2.7.0) allows authenticated users with the upload_files capability - Author role and above - to upload unsanitized SVG or SVGZ files containing embedded JavaScript. When a victim visits or previews a page rendering the malicious file, the script executes in their browser under the site's origin, potentially enabling session hijacking or privilege escalation to administrator. No active exploitation is confirmed via CISA KEV, but a publicly available proof-of-concept exists and a vendor patch has been released at version 2.7.0.
DOM-based cross-site scripting (XSS) in Wealcoder Animation Addons for Elementor through version 2.6.1 allows authenticated attackers with low privileges to inject malicious scripts that execute in users' browsers with the click of a link. The vulnerability stems from improper input neutralization during web page generation and affects all versions of the plugin up to and including 2.6.1. With an EPSS score of 0.03% and no confirmed active exploitation, this represents a lower-priority vulnerability despite the authenticated attack requirement.