WordPress security by component
Happy Addons for Elementor
Plugin description
Happy Addons for Elementor is a WordPress component with 28 published CVE records in this archive. The latest tracked vulnerability was published May 07, 2026; the highest CVE/CNA score is 8.5.
Plugin slug:
happy-elementor-addonsLatest vulnerability
CVE-2026-25468: Happy Addons for Elementor: A security weakness
Happy Addons for Elementor is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 3.20.8.
| Safe version |
|
||
|---|---|---|---|
| May 07, 2026 |
CVE-2026-25468
Happy Addons for Elementor: A security weakness
Happy Addons for Elementor is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 3.20.8.
|
3.21.0 |
CVE5.3
NVDPending
|
| Mar 11, 2026 |
CVE-2026-2918
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVDPending
|
| Mar 11, 2026 |
CVE-2026-2917
Happy Addons for Elementor: A security weakness
Happy Addons for Elementor is affected by a security weakness. Exploitation requires at least contributor-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.4
NVDPending
|
| Feb 03, 2026 |
CVE-2026-1210
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVDPending
|
| Jan 22, 2026 |
CVE-2025-68999
Happy Addons for Elementor: SQL injection
Happy Addons for Elementor is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.5
NVDPending
|
| Dec 23, 2025 |
CVE-2025-14635
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVDPending
|
| Dec 09, 2025 |
CVE-2025-63077
Happy Addons for Elementor: A security weakness
Happy Addons for Elementor is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Mar 27, 2025 |
CVE-2025-30766
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Sep 25, 2024 |
CVE-2024-8801
Happy Addons for Elementor: Sensitive information exposure
Happy Addons for Elementor is affected by sensitive information exposure. Exploitation requires at least contributor-level access. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Jul 27, 2024 |
CVE-2024-6627
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Jun 29, 2024 |
CVE-2024-5790
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| May 31, 2024 |
CVE-2024-5347
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| May 31, 2024 |
CVE-2024-5041
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| May 18, 2024 |
CVE-2024-5088
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| May 18, 2024 |
CVE-2024-4865
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| May 16, 2024 |
CVE-2024-4391
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| May 16, 2024 |
CVE-2024-4478
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| May 08, 2024 |
CVE-2024-24833
Happy Addons for Elementor: A security weakness
Happy Addons for Elementor is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVD8.8
|
| Apr 22, 2024 |
CVE-2024-32698
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVD5.4
|
| Apr 09, 2024 |
CVE-2024-2786
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.4
NVDPending
|
| Apr 09, 2024 |
CVE-2024-1498
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Apr 09, 2024 |
CVE-2024-1387
Happy Addons for Elementor: A security weakness
Happy Addons for Elementor is affected by a security weakness. Exploitation requires at least contributor-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Mar 19, 2024 |
CVE-2024-29108
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVD5.4
|
| Feb 29, 2024 |
CVE-2024-0838
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Feb 29, 2024 |
CVE-2024-0438
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Jan 11, 2024 |
CVE-2023-6632
Happy Addons for Elementor: Cross-site scripting
Happy Addons for Elementor is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Dec 29, 2023 |
CVE-2023-51676
Happy Addons for Elementor: Server-side request forgery
Happy Addons for Elementor is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.
|
See mitigation notes |
CVE4.9
NVD6.5
|
| Jul 10, 2023 |
CVE-2023-28989
Happy Elementor Addons: Cross-site request forgery
Happy Elementor Addons is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVD8.8
|