PLUGIN SECURITY
Known vulnerabilities, PHP compatibility and safer alternatives for the Happy Elementor Addons Pro WordPress plugin — checked against WP Clinic's local security database.
happy-elementor-addons-pro3 known CVEs on file for Happy Elementor Addons Pro. Reported between 2021 and 2024.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2023-6632 | Happy Addons for Elementor Pro [happy-elementor-addons-pro] < 2.10.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.10.0 | 2.10.0 | 2024-01-11 | — |
| CVE-2023-41236 | Happy Addons for Elementor Pro [happy-elementor-addons-pro] < 2.8.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 2.8.1 | 2.8.1 | 2023-08-29 | — |
| CVE-2021-24292 | Happy Addons for Elementor Pro [happy-elementor-addons-pro] < 1.17.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.17.0 | 1.17.0 | 2021-04-26 | — |
The Happy Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via DOM in all versions up to and including 3.9.1.1 (versions up to 2.9.1.1 in Happy Addons for Elementor Pro) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Source: CVE.org
No patched version is available. No reply from the vendor. Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Happy Elementor Addons Pro Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.
Source: Patchstack
The plugins have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method: The “Card” widget accepts a “title_tag” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request with the “heading_tag” set to “script”, and the actual “title” parameter set to JavaScript to be executed within the script tags added by the “heading_tag” parameter. This JavaScript will then be executed when the saved page is viewed or previewed. The other widgets that appear to be exploitable in this manner are: fun-factor: "title_tag" script tag + Javascript in "fun_factor_title" parameter gradient-heading: "title_tag" script tag + Javascript in "title" parameter icon-box: "title_tag" script tag + Javascript in "title" parameter infobox: "title_tag" script tag + Javascript in "title" parameter member: "title_tag" script tag + Javascript in "title" parameter post-list: "title_tag" script tag + Javascript in "title" parameter review: "title_tag" script tag + Javascript in "title" parameter step-flow: "title_tag" script tag + Javascript in "title" parameter These vulnerabilities are nearly identical to the vulnerabilities we have recently disclosed in the main Elementor plugin: https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/
Source: WPScan
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.