CVE-2026-13330 — Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload
The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users wi…
Published: 2026-07-30 · CVSS: 6.1 · CVSS 3.1
The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the upload_files capability (Author and above) to upload files containing malicious JavaScript, leading to Stored Cross-Site Scripting.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7