The Animation Addons for Elementor plugin for WordPress does not sanitize SVG and SVGZ files that a user uploads, allowing anyone with the "upload_files" capability (Authors and above) to store JavaScript content on the site. The stored script executes within a visitor’s browser, which can lead to session hijacking, credential theft, or site defacement. This flaw is classified as a Stored XSS vulnerability (CWE‑79).

WordPress sites running the Animation Addons for Elementor plugin prior to version 2.7.0 are vulnerable. No particular vendor name is listed; the plugin itself and all users of that plugin are affected until the plugin is updated to 2.7.0 or later.

The CVSS score of 6.1 indicates moderate severity, but the EPSS score of less than 1 % shows a low probability of exploitation at the time of analysis. The flaw is not currently listed in CISA’s KEV catalog. The attack requires a user with upload_files permission to upload a crafted SVG/SVGZ; the attacker could then target visitors to the site by embedding malicious scripts. The impact is limited to those who can upload files, but any site visitor may be affected once the script is stored.