CVE-2026-62080

The Happy Addons for Elementor plugin in versions up to 3.50.1 contains a missing authorization vulnerability due to incorrectly configured access control security levels. This may allow exploitation of misconfigured security mechanisms.

The Happy Addons for Elementor plugin (up to version 3.50.1) is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.

Stored XSS vulnerability in the Happy Addons for Elementor plugin by weDevs. Improper input neutralization during page generation allows persistent execution of malicious scripts.

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_page_custom_js' parameter in all versions up to and including 3.20.3 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts into pages that execute when a user visits the injected page, despite the intended restriction of Custom JS to Administrators.

The Happy Addons for Elementor plugin (versions up to and including 3.20.3) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This may allow unauthorized access to functions or data.