CVE-2026-116850: WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability

Q: Does an attacker need an account or other existing access to exploit this issue?

Yes. The CVSS vector indicates low privileges are required, so exploitation is not unauthenticated. It also requires user interaction and can be attempted over the network with low attack complexity.

Q: What is the expected security impact if exploitation succeeds?

The CVSS vector rates confidentiality, integrity, and availability impact as low, with scope changed. The issue is a stored XSS vulnerability, so impact depends on a victim interacting with attacker-controlled content.

Published Oct 29, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade weDevs Happy Addons for Elementor to a version that resolves this vulnerability.
Fixed in 3.51.0

Event History

Oct 29, 2026

CVE Published

via MITRE·02:29 PM

Data Sourced

via MITRE·02:29 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does an attacker need an account or other existing access to exploit this issue?

Yes. The CVSS vector indicates low privileges are required, so exploitation is not unauthenticated. It also requires user interaction and can be attempted over the network with low attack complexity.

What is the expected security impact if exploitation succeeds?