# Advanced Block Animation <= 4.4.2 - Unauthenticated DOM-Based Cross-Site Scripting via Inline HTML Preview Script

- **ID:** WPSEC-2026-1425
- **Plugin:** AI website builder for the block editor and Elementor – Advanced Addons (`advanced-animation`), https://wordpress.org/plugins/advanced-animation/
- **Affected versions:** all versions before 4.5.0
- **Fixed in:** 4.5.0 (Update to 4.5.0 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/advanced-animation
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1425/

## Description

The Advanced Addons plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the inline HTML preview script in all versions up to, and including, 4.4.2. The cause is that the script, printed in the footer of every front-end page for logged-in users when Elementor is active, takes the text of any heading or paragraph element on the page, treats escaped tag text as markup, and assigns it to innerHTML without sanitization. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a logged-in user's browser, such as an administrator's. The attacker places tag-like text in content that the page shows escaped inside a heading or paragraph, such as a search query reflected in the page title, a comment, or post content written by a contributor, and gets the user to view the page or follow a link.

## References

- https://wpsec.com/vuln/WPSEC-2026-1425/
- https://plugins.svn.wordpress.org/advanced-animation/tags/4.5.0/
- https://wordpress.org/plugins/advanced-animation/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1425/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.