CVE-2026-15299: Stored XSS in Animation Addons for Elementor Weather Widget

Technical summary

The vulnerability stems from insufficient output escaping in the Weather widget's render() function (widgets/weather.php:1246). The plugin fails to apply esc_attr() when inserting the 'weather_style' and 'move_direction' parameter values into HTML class attributes. Elementor's architecture does not validate SELECT control values server-side against their allowed option sets during the save_builder AJAX request, allowing an authenticated attacker to submit arbitrary values in the _elementor_data post meta. When the widget renders on the frontend, these unescaped values are directly output into the DOM, enabling JavaScript execution. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

Organizations relying on this plugin for animated weather displays face several risks: unauthorized modification of page content and UI, potential credential theft from site visitors through session hijacking, malware injection, and damage to brand trust if malicious content appears on customer-facing pages. The attack requires legitimate site access (Contributor role or above), making it a threat primarily from compromised accounts, disgruntled insiders, or supply chain incidents. The impact scales with the number of site visitors exposed to the stored payload.

Affected systems

Animation Addons for Elementor WordPress plugin versions 2.6.3 and earlier. The vulnerability is only triggered when the Weather widget is active on a page and configured with a valid OpenWeatherMap API key. WordPress installations using this plugin with Contributor or Author accounts are most at risk. The plugin's presence in the WordPress ecosystem suggests exposure across a broad range of small-to-medium business and agency websites.

Exploitability

Exploitation requires valid WordPress authentication at Contributor level or above—a moderately high privilege threshold that excludes unauthenticated users and site subscribers. However, the attack surface is wider than it appears: compromised plugin accounts, employee negligence, or weak credential management can grant attackers the necessary access. Once stored, the payload executes automatically on every frontend pageload without additional user interaction, making persistence trivial. CVSS 3.1 score of 6.4 (MEDIUM) reflects the authentication requirement offset by network accessibility, low attack complexity, and cross-site impact scope.

Remediation

Upgrade Animation Addons for Elementor to a patched version beyond 2.6.3 (verify current release version against the vendor advisory). The fix should include esc_attr() calls on the vulnerable parameters and ideally server-side validation of widget settings against whitelisted option values. Until patching is complete, restrict Contributor and Author role assignments to trusted users only, audit existing user accounts with these roles, and consider disabling the Weather widget if it is not actively used. Monitor _elementor_data post meta for anomalous values.

Patch guidance

Check the plugin's official WordPress.org repository or vendor site for the latest available version. Apply the update immediately in a staging environment to verify compatibility with your theme and other plugins. Given the authentication requirement, this can be prioritized slightly below zero-day remote code execution vulnerabilities, but should still be treated as urgent due to the ease of persistence once an account is compromised. Enable automatic plugin updates if your operational security posture permits.

Detection guidance

Search WordPress post meta for instances of the Weather widget containing suspicious or unexpected values in the weather_style and move_direction fields within _elementor_data serialized data. Monitor WordPress user audit logs for Contributor and Author account creation, role elevation, or suspicious save_builder AJAX requests from unexpected IP addresses or at unusual times. Inspect frontend page source HTML and browser console for unexpected script execution on pages containing the Weather widget. Web application firewalls can flag unusual class attribute values if rules are tuned appropriately, though escaping bypass techniques may evade simple patterns.

Why prioritize this

Although the CVSS score of 6.4 is classified as MEDIUM severity, this vulnerability merits elevated priority for environments where Contributor accounts are actively used or where user account compromise is a plausible threat vector. The stored nature of the XSS ensures high impact persistence and broad exposure. Organizations with lax access controls, shared hosting, or high-turnover content teams should treat this as HIGH priority. The lack of zero-click exploitation limits urgency for tightly governed enterprise environments, but small-to-medium businesses running WordPress should patch quickly.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects: Network-based attack vector (AV:N), low attack complexity (AC:L), requirement for low privilege authentication (PR:L), no user interaction required (UI:N), and changed scope affecting resources beyond the vulnerable component (S:C). Confidentiality and Integrity impact are LOW (C:L, I:L) and Availability is NONE (A:N), as the attack modifies displayed content and can steal session cookies but does not directly degrade service or destroy data. The score appropriately penalizes the authentication requirement but does not fully capture the reputational and operational risk in practice for sites with weak access controls.

Frequently asked questions