{
 "id": "WPSEC-2026-1055",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1055/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1055/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1055/index.md",
 "title": "Animation Addons for Elementor <= 4.2.6 - Authenticated (Author+) Stored Cross-Site Scripting via Posts and Video Posts Tab Widgets Post Title",
 "description": "The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in the Posts and Video Posts Tab widgets in all versions up to, and including, 4.2.6, due to the post title being printed into the thumbnail link's aria-label attribute with the_title(), which does not escape for attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts through a crafted title on a published post. The scripts run whenever a user opens a page where one of these widgets lists that post.",
 "plugin": {
  "slug": "animation-addons-for-elementor",
  "name": "Animation Addons for Elementor",
  "full_name": "Animation Addons for Elementor – Elementor V4 Atomic Widgets, GSAP Animations & Templates",
  "wordpress_org": "https://wordpress.org/plugins/animation-addons-for-elementor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/animation-addons-for-elementor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/animation-addons-for-elementor"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.2.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.2.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.2.7",
 "remediation": "Update to 4.2.7 or later.",
 "fix_released": "2026-10-15T09:35:40+00:00",
 "published": "2026-10-16T10:47:15+00:00",
 "updated": "2026-10-16T09:50:27.823305+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1055/",
  "https://plugins.svn.wordpress.org/animation-addons-for-elementor/tags/4.2.7/",
  "https://wordpress.org/plugins/animation-addons-for-elementor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/animation-addons-for-elementor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-16"
 }
}