CVE-2026-39702
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Animation Addons for Elementor plugin for WordPress (versions up to and including 2.6.1) contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject a malicious script that executes in the victim's browser.
Risk Assessment
An attacker can execute arbitrary scripts in the victim's context, potentially leading to data theft or session hijacking.
Recommendation
Update the Animation Addons for Elementor plugin to version 2.6.2 or later if available; otherwise, remove or disable the plugin.
Other vulnerabilities in Animation Addons for Elementor
See all- CVE-2026-17565High
The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.
- CVE-2026-13330Medium
The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitize uploaded SVG/SVGZ files, which it adds to the list of allowed upload types. Users with the upload_files capability (Author and above) can upload files containing malicious JavaScript, leading to Stored Cross-Site Scripting.
- CVE-2026-15299Medium
The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'weather_style' and 'move_direction' parameters of the Weather widget in all versions up to and including 2.6.3. This is due to insufficient output escaping in the widget's render() function.
- CVE-2025-8444Medium
The Animation Addons for Elementor WordPress plugin up to version 2.6.7 has a DOM-Based Stored XSS vulnerability via multiple parameters due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary scripts.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wealcoder Animation Addons for Elementor animation-addons-for-elementor allows DOM-Based XSS.This issue affects Animation Addons for Elementor: from n/a through <= 2.6.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS