CVE-2026-17565
Received
Received - Intake
Server-Side Request Forgery in Animation Addons for Elementor
Vulnerability report for CVE-2026-17565, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-08-19
Last updated on: 2026-08-19
Assigner: WPScan
Description
Description
The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| animation_addons | animation_addons_for_elementor | to 2.7.2 (exc) |
| animation_addons_for_elementor | animation_addons_for_elementor | to 2.7.2 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
