Skip to content
Sign in
6.1 Medium

CVE-2026-13330 The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it…

Description

The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the upload_files capability (Author and above) to upload files containing malicious JavaScript, leading to Stored Cross-Site Scripting.

Affected products and versions

Product Affected versions Fixed in
Animation Addons for Elementor 2.7 earliest → < 2.7.0 2.7.0

Other CVEs of Animation Addons for Elementor

The 2 CVEs of Animation Addons for Elementor →
CVE-2026-17565 The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using… 7.2 High
Track this CVE