Advanced Block Animation <= 4.4.2 - Unauthenticated DOM-Based Cross-Site Scripting via Inline HTML Preview Script
- ID
- WPSEC-2026-1425
- Plugin
- AI website builder for the block editor and Elementor – Advanced Addons (advanced-animation)
- Affected
- all versions before 4.5.0
- Remediation
- Update to 4.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Advanced Block Animation on WPSec AttackSurface
- Fix released
- Published
Description
The Advanced Addons plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the inline HTML preview script in all versions up to, and including, 4.4.2. The cause is that the script, printed in the footer of every front-end page for logged-in users when Elementor is active, takes the text of any heading or paragraph element on the page, treats escaped tag text as markup, and assigns it to innerHTML without sanitization. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a logged-in user's browser, such as an administrator's. The attacker places tag-like text in content that the page shows escaped inside a heading or paragraph, such as a search query reflected in the page title, a comment, or post content written by a contributor, and gets the user to view the page or follow a link.
References
- https://wpsec.com/vuln/WPSEC-2026-1425/
- https://plugins.svn.wordpress.org/advanced-animation/tags/4.5.0/
- https://wordpress.org/plugins/advanced-animation/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS