CVE-2025-8444: Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates <= 2.6.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters
The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the multiple parameters in all versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8444?
The severity of CVE-2025-8444 is classified as medium with a score of 6.4.
How does CVE-2025-8444 affect users?
CVE-2025-8444 allows authenticated users with Contributor+ roles to exploit DOM-Based Stored Cross-Site Scripting vulnerabilities.
What versions are affected by CVE-2025-8444?
CVE-2025-8444 affects all versions of Animation Addons for Elementor up to and including 2.6.7.
How do I fix CVE-2025-8444?
To fix CVE-2025-8444, update the Animation Addons for Elementor plugin to the latest version that addresses this vulnerability.
What is the cause of CVE-2025-8444?
CVE-2025-8444 is caused by insufficient input sanitization and output escaping in the plugin.