CVE-2025-8444 is a DOM-Based Stored Cross-Site Scripting vulnerability in the Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates plugin for WordPress. It affects all versions up to and including 2.6.7. The issue stems from improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of multiple parameters. Authenticated attackers with Contributor-level privileges or higher can exploit this to inject malicious scripts that execute in the context of users viewing the compromised pages.

Successful exploitation allows an attacker with Contributor-level or higher access to inject and store malicious scripts within pages. These scripts execute in the browsers of users who access the infected pages, potentially leading to unauthorized actions such as session hijacking or data theft. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent.

No official patch or remediation is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates on fixes. Until a patch is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the affected plugin version. Avoid granting unnecessary privileges to reduce exploitation risk.