CVE-2026-15299 is a stored cross-site scripting vulnerability in the Animation Addons for Elementor plugin (versions <=2.6.3). The issue is due to insufficient output escaping in the Weather widget's render() function, where the 'weather_style' and 'move_direction' parameters are placed directly into an HTML class attribute without esc_attr(). Elementor does not validate these widget SELECT control values server-side on save, enabling an authenticated user with Contributor-level access or higher to submit a crafted AJAX request that stores arbitrary values in the _elementor_data post meta. These stored values render unescaped on every frontend visit to the affected page, exposing visitors to XSS attacks. The vulnerability requires the widget to be operational with an OpenWeatherMap API key.

An attacker with Contributor-level or higher privileges can inject malicious scripts that are stored and executed in the context of site visitors viewing the affected Weather widget. This can lead to partial compromise of confidentiality and integrity (CVSS impact: low confidentiality and integrity impact, no availability impact). The vulnerability enables cross-site scripting attacks that may be used to steal user data, perform actions on behalf of users, or deliver further attacks.

No official patch or fix is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the Weather widget if possible. Monitor for updates from the vendor and apply any official fixes promptly once available.