Happy Addons for Elementor: Stored Cross-Site Scripting (XSS)
Summary
Happy Addons for Elementor is a WordPress plugin that extends the Elementor page builder. Versions up to and including 3.51.0 contain a stored Cross-Site Scripting (XSS) vulnerability. An attacker with a low-privileged account, such as Contributor, can store malicious scripts that run in the browser of a user who views the poisoned content, which can lead to theft of visitor data or hijacked accounts.
Affected
- Happy Addons for Elementor (WordPress plugin, package happy-elementor-addons) up to and including 3.51.0
- The CVE record lists the range as "n/a" through 3.51.0, which is treated as all versions up to and including 3.51.0
Fixed in
- Update to version 3.51.3 or later (per Patchstack and the vendor release notes)
Workaround
- No vendor workaround known. Update first.
- If an update cannot be applied immediately: restrict contributor-level and higher accounts to trusted users and review recently submitted content from lower-privileged users.
Exploitation
- Not known to be exploited in the wild (OffSeq, data as of 11 Nov 2026)
- Not listed in CISA KEV
- No public proof of concept found; the assessment is fresh and may change
Our recommendation
- Update Happy Addons for Elementor to version 3.51.3 or later as a priority on multi-user sites, and in the next maintenance cycle otherwise.
- Check which plugin versions are installed on all WordPress sites, including staging systems.
- Review user accounts with contributor or higher roles and remove unneeded ones.
- Do not use nulled or pirated Pro copies, as they do not receive vendor fixes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: Happy Addons for Elementor XSS patchstack.com
- OffSeq Radar: CVE-2026-123473 radar.offseq.com
- Strix AI: CVE-2026-123473 www.strix.ai
- GitHub release v3.51.3 (team-leevio/happy-elementor-addons) github.com
- WordPress.org plugin page: Happy Addons for Elementor wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:42.
Original description (NVD)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.51.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.