There is currently a confusing security situation around Animation Addons for Elementor.

A site owner running:

Animation Addons for Elementor
Version 2.7.4

may receive a Patchstack warning stating that the plugin is affected by a Cross-Site Scripting vulnerability.

At the same time:

WordPress.org latest downloadable version
→ 2.7.4

while the plugin’s own WordPress.org changelog already contains:

Version 2.7.5
25 August 2026

with several security-related changes.

That raises an obvious question:

If 2.7.4 is considered vulnerable and 2.7.5 exists in the changelog, why can’t WordPress users actually update to 2.7.5?

There is an additional complication: the major vulnerability databases currently do not agree on the exact affected version range.

That makes this more than a simple “click Update” situation.

Current WordPress.org Version: 2.7.4

As of August 27, 2026, the current WordPress.org plugin listing identifies 2.7.4 as the available release.

The plugin has approximately:

10,000+ active installations

and 2.7.4 was released on August 20, 2026.

So if you visit:

Dashboard
→ Plugins

and WordPress says:

Animation Addons for Elementor
Version 2.7.4
No update available

that is currently consistent with what the WordPress.org directory is serving.

This is not necessarily a WordPress update-cache problem.

Yet the Changelog Already Lists 2.7.5

The strange part is that current WordPress.org mirrors now contain this entry:

Animation Addons for Elementor v2.7.5
25 August 2026

The listed changes include:

• stronger Post Rating Form validation and authorization,
• server-side moderation enforcement,
• review-count synchronization,
• hardened AJAX handlers,
• stronger capability checks,
• nonce checks,
• general stability and compatibility improvements.

So we currently have:

CHANGELOG
2.7.5 exists
✓

WORDPRESS.ORG INSTALLABLE VERSION
2.7.5 available
✗

That usually means the plugin’s readme.txt or changelog was updated before the corresponding release package became the directory’s stable version.

It may simply be a release-publishing delay, but until the package is actually available, users cannot safely treat an unreleased changelog entry as an installed security patch.

Do Not Download a Random “2.7.5” ZIP From Another Website

If WordPress.org still supplies 2.7.4, do not respond by searching for:

Animation Addons 2.7.5 download

and installing a ZIP from an unofficial GPL mirror or file-sharing website.

For a security update, the integrity of the plugin package is particularly important.

Wait for:

WordPress.org

or the plugin developer’s verified official distribution channel.

The presence of a 2.7.5 changelog entry alone does not prove that any third-party ZIP claiming to be 2.7.5 is genuine.

Patchstack Currently Flags 2.7.4

Patchstack’s main vulnerability history page currently lists two unresolved Animation Addons vulnerabilities and identifies the plugin’s latest version as:

2.7.4

For the June 9 XSS entry, that overview currently reports:

Affected:
<= 2.7.4

and another XSS entry dated March 1 is also currently shown as affecting:

<= 2.7.4

So the user’s concern is legitimate.

According to that Patchstack summary, installing the latest version currently available from WordPress.org does not clear the vulnerability status.

But Patchstack’s Own Detail Page Says Something Different

This is where the situation becomes especially confusing.

Opening the specific Patchstack advisory linked for the June vulnerability currently shows:

Affected versions:
<= 2.6.9

rather than:

<= 2.7.4

and it states:

No official patch available

The advisory identifies the vulnerability as Cross-Site Scripting, requiring Contributor-level access, with a CVSS score of approximately 6.5.

So Patchstack currently contradicts itself:

Patchstack vulnerability overview
<= 2.7.4

Patchstack individual advisory
<= 2.6.9

That inconsistency should be acknowledged instead of silently assuming either value is definitely correct.

Wordfence Says the Vulnerability Ends at 2.6.7

The linked vulnerability corresponds to:

CVE-2025-8444

Wordfence Intelligence describes it as:

Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting via multiple parameters.

Wordfence currently states that affected versions are:

<= 2.6.7

and still labels the vulnerability as:

Patched? No

Its remediation says there is no known patch and suggests removing/replacing the software where appropriate based on risk tolerance.

So now we have three different version ranges:

Source	Currently reported affected versions
Patchstack overview	<= 2.7.4
Patchstack advisory detail	<= 2.6.9
Wordfence Intelligence	<= 2.6.7

That is a significant discrepancy.

NVD Also Says 2.6.7

The U.S. National Vulnerability Database entry for CVE-2025-8444 currently describes Animation Addons as vulnerable through:

2.6.7

The NVD description says insufficient input sanitization and output escaping can allow authenticated users with Contributor-level access or higher to inject scripts into affected content.

So NVD currently agrees with Wordfence:

NVD:
<= 2.6.7

Wordfence:
<= 2.6.7

while Patchstack’s current records have broader ranges.

Why Might Patchstack Show 2.7.4?

There are several possibilities.

The most obvious is that the security database has re-evaluated later releases and determined that the vulnerable JavaScript/code path remained present after 2.6.7.

Another possibility is a metadata synchronization problem.

Patchstack’s main plugin overview may have extended the affected range automatically because no version was explicitly identified as patched.

That could produce logic such as:

Known vulnerability
+
No confirmed patched version
+
Latest plugin = 2.7.4
↓
Display affected <= 2.7.4

while the underlying CVE record still says:

<= 2.6.7

I cannot confirm which explanation is correct from the currently published records.

The important point is:

The public vulnerability databases are inconsistent right now.

Do Not Assume 2.7.4 Is Safe Just Because It Is Newer

Normally this logic would be reasonable:

Vulnerability affects <= 2.6.7

Installed:
2.7.4

Therefore:
Safe

But the current Patchstack warning complicates that conclusion.

If a security scanner is explicitly warning:

2.7.4 vulnerable

and the vendor has simultaneously added a security-focused:

2.7.5

entry to its changelog, I would not simply dismiss the alert.

The safer position is:

2.7.4 security status
= currently disputed

until either:

1. Patchstack corrects the affected version range,
2. Wordfence/NVD update their data,
3. the vendor confirms which version contains the fix,
4. or 2.7.5 becomes publicly downloadable and is confirmed as patched.

Does 2.7.5 Definitely Fix CVE-2025-8444?

Not from the changelog alone.

This distinction matters.

The 2.7.5 changelog mentions security improvements involving:

Post Rating Form
AJAX handlers
autocomplete endpoints
capability checks
nonce checks

The vulnerability in CVE-2025-8444 is described by Wordfence as a DOM-Based Stored XSS through multiple parameters.

Those descriptions do not clearly match.

Therefore it would be inaccurate to state:

Version 2.7.5 definitely patches CVE-2025-8444.

It may.

But the currently published changelog does not explicitly name:

CVE-2025-8444

or say:

Fixed DOM-Based Stored XSS

So confirmation from the developer or vulnerability database would be preferable.

What Does the Vulnerability Allow?

According to Wordfence and NVD, CVE-2025-8444 is an authenticated Stored Cross-Site Scripting vulnerability.

The attacker must have at least:

Contributor

level access.

The simplified attack chain is:

Attacker obtains Contributor account
↓
Supplies malicious content/parameters
↓
Plugin insufficiently sanitizes or escapes it
↓
Payload becomes stored in content
↓
Another user loads affected page
↓
Malicious JavaScript executes

Because the script executes in the victim’s browser, the potential impact can include:

session actions
admin-side actions
malicious redirects
content manipulation
credential/phishing UI injection

depending on where and under whose session the payload executes.

This Is Not an Unauthenticated Critical RCE

The vulnerability should still be addressed, but it is useful to keep the risk in perspective.

The public records describe:

Required privilege:
Contributor+

and assign it a medium-range CVSS score around:

6.4 / 6.5

So this is not currently described as:

Unauthenticated Remote Code Execution

or:

Unauthenticated admin takeover

That matters when deciding what to do while waiting for a release.

Sites Without Contributor Accounts Have Less Exposure

Suppose your WordPress users are only:

Administrator
Editor
Customer
Subscriber

and only trusted administrators/editors can modify Elementor content.

An attacker cannot directly exploit a Contributor+ authenticated vulnerability without first obtaining an account with sufficient permissions.

That reduces practical exposure.

It does not make vulnerable code desirable, but it may allow you to manage the risk temporarily while waiting for a confirmed update.

Sites With User-Contributed Content Need More Caution

The situation changes if your site gives untrusted people:

Contributor
Author
Editor

access.

Examples include:

multi-author blogs
community publishing sites
client portals
editorial networks
membership sites with publishing permissions

For those sites, the prerequisite for exploitation may already exist.

I would treat the unresolved version discrepancy more seriously there.

What I Would Do If Running 2.7.4 Right Now

Because there is no universally agreed patched version currently downloadable, I would use a risk-based approach.

1. Confirm the Installed Version

Go to:

Plugins
→ Installed Plugins

Check:

Animation Addons for Elementor
Version 2.7.4

Do not rely only on a security scanner’s cached inventory.

2. Confirm That WordPress Truly Has No Update

Go to:

Dashboard
→ Updates
→ Check Again

At the time of verification, WordPress.org still identifies 2.7.4 as the available release, despite showing a 2.7.5 changelog entry.

So not seeing an update is currently expected.

3. Do Not Ignore Patchstack’s Warning Yet

Given the discrepancy between:

Patchstack
Wordfence
NVD

I would not mark the issue as:

False Positive

permanently yet.

Wait for the databases or developer to reconcile the affected range.

4. Review WordPress User Roles

Go to:

Users
→ All Users

Look specifically for accounts with:

Contributor
Author
Editor
Administrator

permissions.

Delete or downgrade unused accounts.

If a user only needs to read the site:

Subscriber

is safer than Contributor.

5. Reset Credentials for Suspicious/Unused Accounts

Because exploitation requires authenticated access, account security matters.

Review:

inactive accounts
old contractor accounts
shared logins
weak passwords
unexpected administrator/editor accounts

Remove anything that should no longer exist.

6. Check Activity Logs if Available

If the site uses:

Wordfence
Solid Security
WP Activity Log
Patchstack
host security logging

review recent content edits and account activity.

Look especially for changes made by:

Contributor
Author

accounts.

7. Consider Temporarily Disabling the Plugin

If:

the site does not depend heavily on Animation Addons

the safest temporary mitigation is:

Deactivate plugin

until a confirmed patched release is available.

However, test this first on staging.

Elementor pages that use Animation Addons widgets can lose styling, content, or functionality while the plugin is disabled.

8. Do Not Delete It Before Testing

If pages rely on its Elementor widgets, immediately deleting the plugin can leave frontend layouts broken.

Prefer:

Backup
↓
Staging
↓
Deactivate
↓
Inspect affected pages

before making the production decision.

9. Update to 2.7.5 Only When It Is Actually Available

Once WordPress offers:

2.7.5

update promptly.

Then check:

Plugins
→ Version 2.7.5

rather than assuming the update succeeded because the changelog changed.

After that, rerun:

Patchstack scan
Wordfence scan
host vulnerability scanner

and see whether the vulnerability is cleared.

10. Verify the Security Databases Again

Even after 2.7.5 arrives, check whether the advisory changes from:

No known patch

to something like:

Patched in 2.7.5

That confirmation is more meaningful than a generic changelog entry saying:

Security improvements

The Plugin Has Had Several Recent Security Issues

Patchstack currently lists multiple vulnerabilities in Animation Addons’ history, including:

• Stored XSS issues,
• an SVG-related Stored XSS fixed around the 2.7.0 line,
• several Contributor+ XSS reports around 2.6.x,
• and an older arbitrary content deletion issue.

For example, a separate Author+ Stored XSS vulnerability affecting versions before 2.7.0 was publicly documented and marked as patched in 2.7.0.

That makes timely updates particularly important for this plugin.

There Is Also a Separate 2.6.3 XSS Vulnerability

Do not confuse CVE-2025-8444 with several other XSS vulnerabilities disclosed around the same time.

Patchstack has separate entries affecting:

<= 2.6.3

that were patched in:

2.6.4

for some affected components.

So a security scanner may show multiple Animation Addons alerts simultaneously.

Always compare:

CVE
PSID
affected range
published date

rather than assuming all the XSS alerts describe one vulnerability.

Why the Exact CVE Matters

For the linked June advisory, the relevant identifier is:

CVE-2025-8444

Wordfence and NVD both currently associate that CVE with:

<= 2.6.7

If your Patchstack dashboard instead says:

<= 2.7.4

take a screenshot and include the CVE/PSID when reporting it.

Otherwise the developer may look up a different Animation Addons XSS issue and give you an answer that does not resolve the actual warning.

A Good Message to Send the Plugin Developer

A concise security report would be:

Patchstack currently flags Animation Addons for Elementor 2.7.4 as vulnerable to XSS. The plugin directory still offers 2.7.4 as the latest downloadable version, but the WordPress.org changelog already includes a 2.7.5 entry dated August 25 with security improvements.

Could you please confirm:

1. Whether version 2.7.4 is affected by CVE-2025-8444 / the Patchstack advisory published June 9;
2. Which version fully patches that vulnerability;
3. Whether 2.7.5 is intended to be the security release;
4. When 2.7.5 will be published as the stable WordPress.org download?

Patchstack’s plugin overview currently says <=2.7.4, while the individual Patchstack advisory says <=2.6.9 and Wordfence/NVD say <=2.6.7, so clarification would be helpful.

That highlights the exact problem without overstating the vulnerability.

Should You Roll Back to 2.6.9?

No.

Rolling backward is not a sensible security response.

Older versions have their own known vulnerabilities.

For example, Patchstack records multiple XSS issues affecting 2.6.x releases, while another vulnerability was only patched in 2.7.0.

Do not do:

2.7.4
↓
2.6.7

just because one database identifies 2.6.7 as the last affected version.

Older software is not safer here.

Should You Manually Patch the JavaScript?

I would not recommend attempting to patch:

assets/js/wcf-addons.min.js

on a production site unless you have verified the vulnerable source code and understand the required sanitization/escaping fix.

Wordfence specifically references that JavaScript asset in its vulnerability record.

Editing a minified production bundle has several problems:

easy to patch incorrectly
hard to audit
overwritten on update
may break Elementor widgets
cannot prove all vulnerable parameters are fixed

A vendor release is preferable.

What If Patchstack Keeps Warning After 2.7.5?

Do not immediately assume the update failed.

Security databases can lag behind plugin releases.

Verify:

Installed version:
2.7.5

WordPress.org:
2.7.5 stable

Patchstack advisory:
patched version?

If the plugin is updated but Patchstack still says:

<= 2.7.4 vulnerable

then 2.7.5 should logically fall outside that affected range.

However, if Patchstack still shows:

No patch available

wait for confirmation or contact Patchstack with the updated package/version information.

The Biggest Problem Right Now Is the Release/Metadata Mismatch

The unusual part is not merely that a vulnerability exists.

The unusual combination is:

Security database:
Latest version 2.7.4 is vulnerable

WordPress.org:
Latest installable version 2.7.4

WordPress.org changelog:
2.7.5 already documented

Actual 2.7.5 update:
not yet offered

That leaves site owners unable to follow the standard advice:

Update to patched version

because the next release is documented but not yet distributed.

Most Likely Explanation

At the moment, the most plausible explanation is:

1. The developer has prepared or documented 2.7.5.
2. Its changelog was pushed to WordPress.org on August 25.
3. The directory is still serving 2.7.4 as the stable release.
4. Vulnerability databases disagree about whether the June XSS remained present beyond 2.6.7/2.6.9.
5. Patchstack’s overview is conservatively treating 2.7.4 as affected because no confirmed patched version has been recorded.

That final point is an inference from the conflicting public data, not something Patchstack or the developer has explicitly confirmed.

Direct Answer

Yes, there is currently a real inconsistency.

As of August 27, 2026:

WordPress.org downloadable version:
2.7.4

while:

WordPress.org changelog:
2.7.5 dated August 25, 2026

and 2.7.5 contains several security-related changes.

Patchstack’s plugin vulnerability overview currently identifies the June XSS as affecting:

<= 2.7.4

However, the individual Patchstack advisory currently says:

<= 2.6.9

while Wordfence and NVD both say:

<= 2.6.7

for CVE-2025-8444.

Therefore I would not claim definitively that 2.7.4 is either vulnerable or patched until the vendor/security databases reconcile the records.

For now:

keep WordPress/Elementor updated
restrict Contributor/Author access
remove unused accounts
monitor the plugin update
do not download unofficial 2.7.5 ZIPs
consider temporarily disabling the plugin on higher-risk sites
update to 2.7.5 when it becomes officially available
then rerun the vulnerability scan

Most importantly, the developer should clarify whether 2.7.5 is the intended fix for CVE-2025-8444 and publish it as the stable WordPress.org release if so.