CVE-2026-123473: WordPress Happy Addons for Elementor plugin <= 3.51.0 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and can attack over the network. User interaction is also required for exploitation.

Q: Which installations are in scope?

Happy Addons for Elementor versions through 3.51.0 are affected. The available information does not identify a first affected version.

Q: What is the expected security impact?

The CVSS vector rates confidentiality, integrity, and availability impact as low, with scope changed. The overall severity is medium with a CVSS score of 6.5.

Published Nov 11, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.51.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Happy Addons for Elementor plugin to a version that resolves this vulnerability.
Fixed in 3.51.3

Event History

Nov 11, 2026

CVE Published

via MITRE·11:47 AM

Data Sourced

via MITRE·11:47 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·12:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and can attack over the network. User interaction is also required for exploitation.

Which installations are in scope?

Happy Addons for Elementor versions through 3.51.0 are affected. The available information does not identify a first affected version.

What is the expected security impact?

The CVSS vector rates confidentiality, integrity, and availability impact as low, with scope changed. The overall severity is medium with a CVSS score of 6.5.

CVE-2026-123473: WordPress Happy Addons for Elementor plugin <= 3.51.0 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which installations are in scope?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which installations are in scope?

What is the expected security impact?