CVE-2026-15299

Name of the Vulnerable Software and Affected Versions Animation Addons for Elementor versions prior to 2.6.4

Description Stored Cross-Site Scripting occurs in the Weather widget due to insufficient output escaping in the render() function. An authenticated attacker with Contributor-level access or higher can send a crafted save builder AJAX request to store arbitrary values in the elementor data post meta via the weather style and move direction parameters. These values are placed into an HTML class attribute without proper sanitization, causing the payload to execute on the frontend for every visitor. This requires the widget to be configured with a valid OpenWeatherMap API key to trigger the output.

Recommendations Update to a version newer than 2.6.3. As a temporary mitigation, restrict access to the Weather widget or limit user permissions to prevent users with Contributor-level access from modifying widget settings.