CVE-2025-8444
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via multiple parameters in all versions up to and including 4.2.6 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts into pages that execute when a user accesses the injected page.
Risk Assessment
An attacker with a Contributor account can inject malicious scripts that execute in visitors' browsers, potentially leading to session or data theft. The risk affects WordPress sites with the vulnerable plugin installed.
Recommendation
Update the Animation Addons for Elementor plugin to a version later than 4.2.6. Until then, restrict Contributor privileges or consider disabling the plugin.
Other vulnerabilities in Animation Addons for Elementor
See all- CVE-2026-17565High
The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.
- CVE-2026-13330Medium
The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitize uploaded SVG/SVGZ files, which it adds to the list of allowed upload types. Users with the upload_files capability (Author and above) can upload files containing malicious JavaScript, leading to Stored Cross-Site Scripting.
- CVE-2026-15299Medium
The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'weather_style' and 'move_direction' parameters of the Weather widget in all versions up to and including 2.6.3. This is due to insufficient output escaping in the widget's render() function.
- CVE-2026-39702Medium
The Animation Addons for Elementor plugin for WordPress (versions up to and including 2.6.1) contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2025-67540Medium
The Animation Addons for Elementor plugin (animation-addons-for-elementor) by Wealcoder has a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 2.4.5.
Original NVD description (English source)
The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the multiple parameters in all versions up to, and including, 4.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS