The Animation Addons for Elementor plugin contains a stored cross‑site scripting flaw (CWE‑79) in the Weather widget. The flaw stems from missing output escaping of the widget’s 'weather_style' and 'move_direction' parameters in a class attribute. When an authenticated user with at least Contributor privileges submits a custom save_builder request, arbitrary JavaScript payloads can be stored and rendered unescaped on every frontend request, allowing code execution in the context of site visitors.

This issue impacts WordPress sites that use the wealcoder Animation Addons for Elementor plugin, versions 2.6.3 and earlier. The vulnerability is tied to the Weather widget which requires an OpenWeatherMap API key, a common configuration for sites employing this widget. All deployments of the affected plugin version are susceptible regardless of the WordPress version or other plugins, as the flaw exists in the plugin’s core PHP logic.

The stated CVSS score of 6.4 classifies the flaw as moderate in severity, but the requirement for contributor‑level access lowers the exploitation barrier relative to a typical public XSS. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV, indicating that there is currently no known widespread exploitation. However, any site that has contributors or higher‑privileged users can use the flaw to inject persistent client‑side scripts, posing a significant risk to all site visitors.