PT-2026-66374

CVE-2026-13330

Published

2026-07-30

Updated

2026-07-30

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Animation Addons for Elementor versions prior to 2.7.0

Description Insufficient sanitization of uploaded SVG and SVGZ files allows authenticated users with the upload files capability (Author level and above) to upload files containing malicious JavaScript. This leads to Stored Cross-Site Scripting, where arbitrary web scripts are injected into pages and execute whenever a user accesses the affected page.

Recommendations Update to version 2.7.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vaibhav Narkhede

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers