Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates < 2.7.0 - Authenticated (Author+) Stored Cross-Site Scripting
medium
The Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 2.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and abo...
- CVSS:
- 6.4
- Affected:
- up to 2.7.0
- Fixed in:
- 2.7.0
- Disclosed:
- Jul 30, 2026
CVE-2026-13330 on NVD →
Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates <= 2.6.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters
medium
The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the multiple parameters in all versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible fo...
- CVSS:
- 6.4
- Affected:
- up to 2.6.7
- Fix:
- No patched version reported
- Disclosed:
- Jun 9, 2026
CVE-2025-8444 on NVD →
Animation Addons for Elementor <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget
medium
The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'weather_style' and 'move_direction' parameters of the Weather widget in all versions up to, and including, 2.6.3. This is due to insufficient output escaping in the Weather widget's render() function at widgets...
- CVSS:
- 6.4
- Affected:
- up to 2.6.3
- Fixed in:
- 2.6.4
- Disclosed:
- May 26, 2026
CVE-2026-15299 on NVD →
Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor...
- CVSS:
- 6.4
- Affected:
- up to 2.6.3
- Fixed in:
- 2.6.4
- Disclosed:
- May 26, 2026
Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor...
- CVSS:
- 6.4
- Affected:
- up to 2.6.3
- Fixed in:
- 2.6.4
- Disclosed:
- May 26, 2026
Animation Addons for Elementor <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web sc...
- CVSS:
- 6.4
- Affected:
- up to 2.6.2
- Fix:
- No patched version reported
- Disclosed:
- Mar 1, 2026
CVE-2026-39702 on NVD →
Animation Addons for Elementor <= 2.4.5 - Authenticated (Contributor+) Arbitrary Content Deletion
medium
The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.4.5. This makes it possible for authenticated attackers, with Contributor-level access...
- CVSS:
- 4.3
- Affected:
- up to 2.4.5
- Fixed in:
- 2.4.6
- Disclosed:
- Dec 15, 2025
CVE-2025-67540 on NVD →
Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates [animation-addons-for-elementor] <= 2.4.5 (unfixed)
unknown
[en] Missing Authorization vulnerability in Wealcoder Animation Addons for Elementor animation-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animation Addons for Elementor: from n/a through <= 2.4.5.
- Affected:
- up to 2.4.5
- Fix:
- No patched version reported
- Disclosed:
- Dec 9, 2025
CVE-2025-67540 on NVD →
Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates [animation-addons-for-elementor] < 1.1.7
unknown
[en] The Animation Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the 'render' function in widgets/content-slider.php and widgets/tabs.php. This makes it possible for authenticated attackers, with Contributor-level access and abo...
- Affected:
- up to 1.1.7
- Fixed in:
- 1.1.7
- Disclosed:
- Dec 18, 2024
CVE-2024-12340 on NVD →
Animation Addons for Elementor <= 1.1.6 - Authenticated (Contributor+) Sensitive Information Exposure via Content Slider and Tabs Widget Elementor Template
medium
The Animation Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the 'render' function in widgets/content-slider.php and widgets/tabs.php. This makes it possible for authenticated attackers, with Contributor-level access and above, t...
- CVSS:
- 4.3
- Affected:
- up to 1.1.6
- Fixed in:
- 1.1.7
- Disclosed:
- Dec 17, 2024
CVE-2024-12340 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database