CVE-2025-63077
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Happy Addons for Elementor plugin (versions up to and including 3.20.3) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This may allow unauthorized access to functions or data.
Risk Assessment
An unauthenticated or low-privileged user could perform actions reserved for higher privileges, potentially leading to content modification or data exposure on the WordPress site.
Recommendation
Update the Happy Addons for Elementor plugin to a version later than 3.20.3. Review and verify user permissions on the WordPress site.
Other vulnerabilities in Happy Addons for Elementor
See all- CVE-2026-62080Medium
Happy Addons for Elementor plugin version 3.23.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by contributors, allowing injection of malicious scripts.
- CVE-2026-109891Medium
The Happy Addons for Elementor plugin in versions up to 3.50.1 contains a missing authorization vulnerability due to incorrectly configured access control security levels. This may allow exploitation of misconfigured security mechanisms.
- CVE-2026-116850Medium
The Happy Addons for Elementor plugin (up to version 3.50.1) is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
- CVE-2026-104393Medium
Stored XSS vulnerability in the Happy Addons for Elementor plugin by weDevs. Improper input neutralization during page generation allows persistent execution of malicious scripts.
- CVE-2025-14635Medium
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_page_custom_js' parameter in all versions up to and including 3.20.3 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts into pages that execute when a user visits the injected page, despite the intended restriction of Custom JS to Administrators.
Original NVD description (English source)
Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through <= 3.20.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS