# Animation Addons for Elementor <= 4.2.6 - Authenticated (Author+) Stored Cross-Site Scripting via Posts and Video Posts Tab Widgets Post Title

- **ID:** WPSEC-2026-1055
- **Plugin:** Animation Addons for Elementor – Elementor V4 Atomic Widgets, GSAP Animations & Templates (`animation-addons-for-elementor`), https://wordpress.org/plugins/animation-addons-for-elementor/
- **Affected versions:** all versions before 4.2.7
- **Fixed in:** 4.2.7 (Update to 4.2.7 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/animation-addons-for-elementor
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1055/

## Description

The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in the Posts and Video Posts Tab widgets in all versions up to, and including, 4.2.6, due to the post title being printed into the thumbnail link's aria-label attribute with the_title(), which does not escape for attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts through a crafted title on a published post. The scripts run whenever a user opens a page where one of these widgets lists that post.

## References

- https://wpsec.com/vuln/WPSEC-2026-1055/
- https://plugins.svn.wordpress.org/animation-addons-for-elementor/tags/4.2.7/
- https://wordpress.org/plugins/animation-addons-for-elementor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1055/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.