CVE-2025-14635
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_page_custom_js' parameter in all versions up to and including 3.20.3 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts into pages that execute when a user visits the injected page, despite the intended restriction of Custom JS to Administrators.
Risk Assessment
Arbitrary JavaScript execution in users' browsers is possible, including admin session hijacking and page content modification.
Recommendation
Update the Happy Addons for Elementor plugin to a version later than 3.20.3, and until then restrict Contributor roles and review unusual scripts in content.
Other vulnerabilities in Happy Addons for Elementor
See all- CVE-2026-62080Medium
Happy Addons for Elementor plugin version 3.23.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by contributors, allowing injection of malicious scripts.
- CVE-2026-109891Medium
The Happy Addons for Elementor plugin in versions up to 3.50.1 contains a missing authorization vulnerability due to incorrectly configured access control security levels. This may allow exploitation of misconfigured security mechanisms.
- CVE-2026-116850Medium
The Happy Addons for Elementor plugin (up to version 3.50.1) is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
- CVE-2026-104393Medium
Stored XSS vulnerability in the Happy Addons for Elementor plugin by weDevs. Improper input neutralization during page generation allows persistent execution of malicious scripts.
- CVE-2025-63077Medium
The Happy Addons for Elementor plugin (versions up to and including 3.20.3) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This may allow unauthorized access to functions or data.
Original NVD description (English source)
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_page_custom_js' parameter in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, despite the intended role restriction of Custom JS to Administrators.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS