Executive brief
The Animation Addons for Elementor plugin for WordPress contains a security flaw that allows users with 'Author' level permissions or higher to upload malicious image files. These files can contain hidden scripts that execute in the browser of other users, including administrators, when the file is viewed. This could lead to unauthorized actions being performed on the website or the theft of sensitive session information.
Technical details
The Animation Addons for Elementor plugin for WordPress (versions prior to 2.7.0) fails to sanitize SVG and SVGZ files during the upload process. The plugin explicitly adds these file types to the WordPress 'upload_mimes' allowlist without implementing any sanitization routines or restricting the capability to administrators only. An authenticated attacker with the 'upload_files' capability (typically Author role and above) can upload an SVG file containing a malicious 'onload' event or other JavaScript payloads. When a victim, such as a site administrator, views the uploaded file directly, the script executes within the context of their session, potentially allowing for session hijacking or unauthorized administrative actions. This issue is resolved in version 2.7.0.
Affected products
- Unknown Animation Addons for Elementor < 2.7.0
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-30: advisory: NVD published date
- 2026-07-30: patched: Fixed in version 2.7.0