CVE-2026-62080: WordPress Happy Addons for Elementor plugin <= 3.23.1 - Cross Site Scripting (XSS) vulnerability
Published Sep 30, 2026
·Updated
Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.
Affected Software
1 affected component
Happy Addons Happy Addons for Elementor<=3.23.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Happy Addons for Elementorto a version that resolves this vulnerability.Fixed in 3.50.0
Event History
Sep 30, 2026
CVE Published
via MITRE·12:26 PM
Data Sourced
via MITRE·12:26 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
An attacker needs Contributor-level privileges. The attack vector is network-based, but user interaction is required.
2
What is the potential impact if the vulnerability is exploited?
Successful exploitation can affect confidentiality, integrity, and availability at a low impact level. The scope is changed, meaning the impact can extend beyond the vulnerable plugin's security authority.
3
Which plugin versions are affected?
Happy Addons for Elementor versions 3.23.1 and earlier are affected.