Vulnerabilities / Animation Addons for Elementor / WPSEC-2026-1055
Animation Addons for Elementor <= 4.2.6 - Authenticated (Author+) Stored Cross-Site Scripting via Posts and Video Posts Tab Widgets Post Title
Medium 6.4
CWE-79Fixed in 4.2.7
- ID
- WPSEC-2026-1055
- Plugin
- Animation Addons for Elementor – Elementor V4 Atomic Widgets, GSAP Animations & Templates (animation-addons-for-elementor)
- Affected
- all versions before 4.2.7
- Remediation
- Update to 4.2.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-16
- Attack surface
- Animation Addons for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in the Posts and Video Posts Tab widgets in all versions up to, and including, 4.2.6, due to the post title being printed into the thumbnail link's aria-label attribute with the_title(), which does not escape for attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts through a crafted title on a published post. The scripts run whenever a user opens a page where one of these widgets lists that post.
References
- https://wpsec.com/vuln/WPSEC-2026-1055/
- https://plugins.svn.wordpress.org/animation-addons-for-elementor/tags/4.2.7/
- https://wordpress.org/plugins/animation-addons-for-elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS