CVE-2026-17565

HighCVSS 7.2/10Last modified Nov 9, 2026

Description

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Unknown	Animation Addons for Elementor	< 2.7.2

References

https://wpscan.com/vulnerability/e88e0b71-145c-4edd-9b62-783215b64c67/

Timeline

Published: Aug 19, 2026
Last modified: Nov 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-175669.9pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template CVE-2026-175675.3The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Di CVE-2026-175688.8Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user hol CVE-2026-175694.3Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry CVE-2026-17576.2A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is CVE-2026-175704.3Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose CVE-2026-175716.1The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected C CVE-2026-175725.5Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a de CVE-2026-175735.5A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via CVE-2026-175745.5HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-leng CVE-2026-175766.5The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments action in versions up to, and including, 1.13 CVE-2026-175776.1The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' (and 'host') parameters in versions up to, an