CVE-2026-15299 Overview
CVE-2026-15299 is a Stored Cross-Site Scripting (XSS) vulnerability in the Animation Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 2.6.3 and resides in the Weather widget's render() function at widgets/weather.php:1246. The weather_style and move_direction parameters are inserted into an HTML class attribute without esc_attr() output escaping. Authenticated users with Contributor-level access or higher can store arbitrary JavaScript payloads that execute for every visitor of the affected page. The vulnerability is tracked under [CWE-79].
Critical Impact
Authenticated Contributors can inject persistent JavaScript that executes in every visitor's browser, enabling session theft, account takeover, and site defacement.
Affected Products
- Animation Addons for Elementor plugin for WordPress — all versions up to and including 2.6.3
- Elementor page builder installations where the Weather widget is configured with an OpenWeatherMap API key
- WordPress sites permitting Contributor-level or higher user registration
Discovery Timeline
- 2026-07-10 - CVE-2026-15299 published to NVD
- 2026-07-10 - Last updated in NVD database
Technical Details for CVE-2026-15299
Vulnerability Analysis
The Animation Addons for Elementor plugin fails to escape user-controlled widget settings when rendering the Weather widget on the frontend. Within widgets/weather.php at line 1246, the plugin concatenates the weather_style and move_direction setting values directly into an HTML class attribute string. Because esc_attr() is not applied, an attacker can break out of the attribute context and inject arbitrary HTML and JavaScript. The stored payload is written to the _elementor_data post meta and rendered on every page load, making the XSS persistent and reflected to every visitor.
Root Cause
Two compounding weaknesses produce the vulnerability. First, Elementor does not perform server-side validation of SELECT control values against the allowed options list at save time, so any string submitted through the save_builder AJAX endpoint is accepted. Second, the Weather widget's render() method trusts these stored values and emits them into HTML output without escaping. The resulting flow allows attacker-controlled data to reach a sensitive HTML sink unchanged.
Attack Vector
An attacker authenticated as a Contributor or above sends a crafted save_builder AJAX request containing malicious values for weather_style or move_direction. The payload is persisted in _elementor_data. When any visitor loads a page rendering the Weather widget, the browser parses the injected markup and executes the attacker's JavaScript in the site's origin. The Weather widget requires an OpenWeatherMap API key to reach the vulnerable code path, which is the standard operational configuration for sites using the widget. Refer to the Wordfence Vulnerability Report and the upstream code changeset for technical details.
Detection Methods for CVE-2026-15299
Indicators of Compromise
- Unexpected HTML tags, quotes, or <script> fragments inside weather_style or move_direction values stored in _elementor_data post meta.
- admin-ajax.php requests with action=save_builder originating from Contributor accounts that modify Weather widget settings.
- Outbound requests from visitor browsers to unfamiliar domains referenced by the affected pages.
Detection Strategies
- Query the wp_postmeta table for _elementor_data entries containing suspicious characters such as <, ", or onerror within Weather widget settings.
- Review WordPress access logs for save_builder AJAX calls made by low-privilege users editing pages containing Weather widgets.
- Compare Weather widget setting values against the plugin's allowed option list; any value outside the enumeration warrants investigation.
Monitoring Recommendations
- Alert on new or modified posts by Contributor-level accounts that include Weather widget markup.
- Monitor frontend responses for inline script content or event handler attributes emitted from Elementor-rendered pages.
- Track spikes in authenticated save_builder requests as a signal of automated exploitation attempts.
How to Mitigate CVE-2026-15299
Immediate Actions Required
- Update the Animation Addons for Elementor plugin to version 2.6.4 or later on every WordPress installation.
- Audit existing Contributor, Author, and Editor accounts and remove any that are unrecognized or inactive.
- Inspect all pages using the Weather widget for injected payloads and restore clean revisions where necessary.
Patch Information
The vendor released version 2.6.4, which introduces output escaping on the affected parameters. Review the patched Weather widget source and the 2.6.3 to 2.6.4 changeset to verify the fix.
Workarounds
- Deactivate the Animation Addons for Elementor plugin until the update to 2.6.4 can be applied.
- Restrict who can register or be promoted to Contributor and higher roles, limiting the pool of accounts able to reach the vulnerable AJAX endpoint.
- Deploy a Web Application Firewall (WAF) rule that inspects save_builder requests for HTML metacharacters in weather_style and move_direction fields.
# Update via WP-CLI
wp plugin update animation-addons-for-elementor --version=2.6.4
wp plugin get animation-addons-for-elementor --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
