CVE-2025-8444
Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates <= 2.6.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters
CVSS Score
6.4
EPSS Score
0.0%
EPSS Percentile
0th
The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the multiple parameters in all versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
| CWE | CWE-79 |
| Vendor | wealcoder |
| Product | animation addons for elementor – gsap motion elementor addons & website templates |
| Published | Jun 10, 2026 |
| Last Updated | Jun 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for wealcoder animation addons for elementor – gsap motion elementor addons & website templates
Be the first to know when new medium vulnerabilities affecting wealcoder animation addons for elementor – gsap motion elementor addons & website templates are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
wealcoder / Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates
0 ≤ 2.6.7
References
Credits
D.Sim