CVE-2026-13330 Overview
CVE-2026-13330 is a Stored Cross-Site Scripting (XSS) vulnerability in the Animation Addons for Elementor WordPress plugin versions prior to 2.7.0. The plugin registers SVG and SVGZ files as allowed upload types without sanitizing their contents. Any authenticated user with the upload_files capability, which includes the Author role and above, can upload crafted SVG files containing malicious JavaScript. When another user views the uploaded file, the embedded script executes in their browser session.
Critical Impact
Authenticated attackers holding Author-level access or higher can inject persistent JavaScript that executes against site administrators, enabling session theft and administrative account takeover.
Affected Products
- Animation Addons for Elementor WordPress plugin versions before 2.7.0
- WordPress sites permitting Author-level or higher registrations
- Elementor-based sites relying on the plugin for animation features
Discovery Timeline
- 2026-07-30 - CVE-2026-13330 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-13330
Vulnerability Analysis
The Animation Addons for Elementor plugin extends WordPress's default upload MIME type list to include Scalable Vector Graphics (SVG) and gzip-compressed SVGZ files. WordPress excludes SVG uploads by default because SVG is an XML-based format that supports embedded scripting through <script> elements and inline event handlers such as onload and onclick.
The plugin adds these file types to the allow list but omits content sanitization. Uploaded SVG files pass through no XML parsing, script-tag stripping, or event-handler filtering. The raw file is stored in the WordPress media library and served with the image/svg+xml content type, causing browsers to render embedded scripts.
The result is a persistent Stored XSS condition [CWE-79]. Payloads execute in the origin of the affected WordPress site whenever administrators, editors, or visitors open the media file directly or view a page embedding it.
Root Cause
The root cause is missing input sanitization on file uploads. The plugin registers additional MIME types through the upload_mimes filter but does not hook into wp_handle_upload_prefilter or apply an SVG sanitizer such as enshrined/svg-sanitize to strip active content from the file body before storage.
Attack Vector
Exploitation requires an authenticated account with the upload_files capability. An attacker with Author role uploads an SVG file containing a <script> element or an event handler on an SVG shape element. The file is stored under /wp-content/uploads/ and referenced by a media library URL. When an administrator previews the attachment or a visitor loads a page embedding the SVG, the JavaScript executes in the site's origin, enabling cookie theft, forced administrative actions via the REST API, or plugin installation.
Refer to the WPScan Vulnerability Report for the technical write-up.
Detection Methods for CVE-2026-13330
Indicators of Compromise
- Files with .svg or .svgz extensions in /wp-content/uploads/ containing <script> tags, javascript: URIs, or on* event handler attributes
- Media library entries uploaded by non-administrator accounts with unusual XML payloads
- Outbound requests from administrator browser sessions to attacker-controlled domains following media library access
- Creation of new administrator accounts or unexpected plugin installations following SVG uploads
Detection Strategies
- Scan the uploads directory for SVG files and grep for <script, onload=, onerror=, and href="javascript: patterns
- Audit the WordPress wp_posts table for attachment entries with post_mime_type of image/svg+xml uploaded by Author-role users
- Review web server logs for POST requests to /wp-admin/async-upload.php returning SVG uploads from lower-privileged accounts
Monitoring Recommendations
- Alert on any SVG or SVGZ file uploads via the WordPress media endpoint
- Monitor for new administrator account creation or role changes shortly after media uploads
- Track outbound requests from authenticated admin sessions to non-approved domains
How to Mitigate CVE-2026-13330
Immediate Actions Required
- Update the Animation Addons for Elementor plugin to version 2.7.0 or later on all WordPress installations
- Audit existing SVG and SVGZ files in the media library and remove any containing script content or event handlers
- Review Author-level and higher accounts for signs of unauthorized activity or unfamiliar users
- Rotate administrator credentials and invalidate active sessions if malicious uploads are found
Patch Information
The vendor addressed the vulnerability in Animation Addons for Elementor version 2.7.0. Administrators should update through the WordPress plugin management interface or WP-CLI. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate the Animation Addons for Elementor plugin until the update is applied
- Remove SVG and SVGZ from allowed upload MIME types using a custom upload_mimes filter
- Restrict the upload_files capability to trusted roles and revoke it from Author accounts where feasible
- Deploy a web application firewall rule blocking SVG uploads containing <script> or on* event attributes
# Update the plugin via WP-CLI
wp plugin update animation-addons-for-elementor --version=2.7.0
# Verify installed version
wp plugin get animation-addons-for-elementor --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
