The Animation Addons for Elementor WordPress plugin versions prior to 2.7.0 allow users with the upload_files capability (Author role and above) to upload SVG/SVGZ files containing malicious JavaScript because these files are added to the allowed upload types without proper sanitization. This results in a stored cross-site scripting (CWE-79) vulnerability, where malicious scripts can be executed in the context of users viewing the affected content. The CVSS 3.1 base score is 6.1, indicating a medium severity vulnerability with network attack vector, low attack complexity, no privileges required beyond upload_files capability, user interaction required, and impacts confidentiality and integrity with no impact on availability.

An attacker with upload_files capability can upload crafted SVG/SVGZ files containing malicious JavaScript, leading to stored XSS. This can compromise confidentiality and integrity of affected users' sessions or data when they view the malicious content. The vulnerability does not affect availability and requires user interaction to trigger.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict upload_files capability to trusted users only and avoid uploading SVG/SVGZ files. Monitor vendor channels for updates regarding a patch or official remediation.