CVE-2026-15299: Animation Addons for Elementor <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget
The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'weatherstyle' and 'movedirection' parameters of the Weather widget in all versions up to, and including, 2.6.3. This is due to insufficient output escaping in the Weather widget's render() function at widgets/weather.php:1246, where both settings values are placed into an HTML class attribute without escattr(). Elementor does not server-side validate widget SELECT control values against allowed options on save, so an authenticated attacker with Contributor-level access or above can submit a crafted savebuilder AJAX request storing arbitrary values in the elementordata post meta. The stored payload renders unescaped on every frontend visit to the affected page (the Weather widget requires an OpenWeatherMap API key to reach the vulnerable output, which is the normal operational state for sites using this widget).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Animation Addons for Elementorto a version that resolves this vulnerability.Fixed in 2.6.3 - Configuration
Patch the Weather widget render() in widgets/weather.php at line 1246 so that the 'weather_style' and 'move_direction' parameter values are escaped with esc_attr() before being inserted into the HTML class attribute.
Animation Addons for Elementor (Weather widget) widgets/weather.php:1246 output escaping for weather_style and move_direction = Use esc_attr() for both settings values before placing them into the HTML class attribute
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15299?
CVE-2026-15299 has a medium severity rating of 6.4.
What is the impact of CVE-2026-15299?
CVE-2026-15299 allows for authenticated stored cross-site scripting through the Weather widget.
How do I fix CVE-2026-15299?
To fix CVE-2026-15299, update the Animation Addons for Elementor plugin to version 2.6.4 or later.
Who is affected by CVE-2026-15299?
All users with Animation Addons for Elementor versions 2.6.3 and earlier are affected by CVE-2026-15299.
What components of the Animation Addons for Elementor are vulnerable in CVE-2026-15299?
The 'weather_style' and 'move_direction' parameters of the Weather widget are vulnerable in CVE-2026-15299.