CVE-2026-15299 is a stored cross-site scripting vulnerability in the Animation Addons for Elementor plugin for WordPress, specifically in the Weather widget. The issue is due to insufficient output escaping of the 'weather_style' and 'move_direction' parameters in the widget's render() function, where these values are placed into an HTML class attribute without using esc_attr(). Elementor does not validate these SELECT control values server-side on save, allowing an authenticated user with Contributor-level permissions or higher to submit a crafted AJAX request that stores arbitrary values in the _elementor_data post meta. The malicious payload is then rendered unescaped on every frontend visit to the affected page, potentially leading to cross-site scripting attacks. The widget requires an OpenWeatherMap API key to reach the vulnerable output, which is typical for sites using this widget.

An attacker with Contributor-level or higher privileges can inject malicious scripts that are stored and executed in the context of users visiting the affected page. This can lead to information disclosure and limited integrity impact (as per CVSS: Confidentiality Low, Integrity Low, Availability None). The vulnerability does not require user interaction beyond visiting the page and does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only. Consider disabling or removing the Weather widget if not needed. Monitor for updates from the vendor or plugin repository for an official fix.