{
 "id": "WPSEC-2026-1425",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1425/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1425/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1425/index.md",
 "title": "Advanced Block Animation <= 4.4.2 - Unauthenticated DOM-Based Cross-Site Scripting via Inline HTML Preview Script",
 "description": "The Advanced Addons plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the inline HTML preview script in all versions up to, and including, 4.4.2. The cause is that the script, printed in the footer of every front-end page for logged-in users when Elementor is active, takes the text of any heading or paragraph element on the page, treats escaped tag text as markup, and assigns it to innerHTML without sanitization. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a logged-in user's browser, such as an administrator's. The attacker places tag-like text in content that the page shows escaped inside a heading or paragraph, such as a search query reflected in the page title, a comment, or post content written by a contributor, and gets the user to view the page or follow a link.",
 "plugin": {
  "slug": "advanced-animation",
  "name": "Advanced Block Animation",
  "full_name": "AI website builder for the block editor and Elementor – Advanced Addons",
  "wordpress_org": "https://wordpress.org/plugins/advanced-animation/",
  "advisories_url": "https://wpsec.com/vuln/plugin/advanced-animation/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/advanced-animation"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.5.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.5.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.5.0",
 "remediation": "Update to 4.5.0 or later.",
 "fix_released": "2026-10-21T08:15:24+00:00",
 "published": "2026-10-22T08:42:12+00:00",
 "updated": "2026-10-21T10:36:02.372320+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1425/",
  "https://plugins.svn.wordpress.org/advanced-animation/tags/4.5.0/",
  "https://wordpress.org/plugins/advanced-animation/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/advanced-animation",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-22"
 }
}