Animation Addons for Elementor Stored Cross-Site Scripting Vulnerability in Weather Widget

A stored cross-site scripting vulnerability has been identified in the Animation Addons for Elementor plugin for WordPress, affecting all versions through 2.6.3. The issue arises in the Weather widget, where the 'weather_style' and 'move_direction' parameters are improperly sanitized before being outputted as HTML class attributes. This flaw allows authenticated users with Contributor-level access or higher to inject malicious scripts that are saved and executed on the frontend. The vulnerability requires an active OpenWeatherMap API key to reproduce, as it pertains to the normal functionality of the Weather widget.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user visiting the affected page.

Reproduction

To reproduce this vulnerability, an authenticated user with Contributor-level access or higher can send a crafted save_builder AJAX request that includes malicious payloads in the 'weather_style' and 'move_direction' parameters of the Weather widget. The injected scripts will be executed on the frontend when the page is visited.

Remediation

Users are advised to update the Animation Addons for Elementor plugin to version 2.6.4 or later, where this vulnerability has been patched.