PLUGIN SECURITY
Is Happy Elementor Addons safe?
HappyAddons packs Header Footer Builder, Megamenu, Single Post, Archive Page, & 500+ Ready Templates into one powerful Elementor Addons plugin.
What this plugin does
- Slug:
happy-elementor-addons - Author: Leevio
- 400000+ active installs
- 96/100 rating (487 reviews on wordpress.org)
- 13787758 all-time downloads
- On WordPress.org since 2019-03-05
elementorelementor addonselementor widgetheader footer buildermega menu
Maintenance status
- Latest known version: 3.23.1
- Last updated: 2026-08-18 11:46am GMT
- Tested up to WordPress: 7.0.4
- Requires PHP: 8.1+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
40 known CVEs on file for Happy Elementor Addons.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-25468 | Happy Addons for Elementor [happy-elementor-addons] < 3.21.0 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | Medium 5.3 | < 3.21.0 | 3.21.0 | 2026-05-07 | ✓ fixed in latest |
| CVE-2025-68999 | Happy Addons for Elementor [happy-elementor-addons] < 3.20.6 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 8.5 | < 3.20.6 | 3.20.6 | 2026-01-22 | ✓ fixed in latest |
| CVE-2025-14635 | Happy Addons for Elementor [happy-elementor-addons] < 3.20.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 3.20.4 | 3.20.4 | 2025-12-22 | ✓ fixed in latest |
| CVE-2025-63077 | Happy Addons for Elementor [happy-elementor-addons] < 3.20.4 | Missing Authorization | Medium 4.3 | < 3.20.4 | 3.20.4 | 2025-12-04 | ✓ fixed in latest |
| CVE-2024-5647 | Happy Addons for Elementor [happy-elementor-addons] < 3.12.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 3.12.3 | 3.12.3 | 2025-07-02 | ✓ fixed in latest |
| CVE-2025-30766 | Happy Addons for Elementor [happy-elementor-addons] < 3.16.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 3.16.3 | 3.16.3 | 2025-03-27 | ✓ fixed in latest |
| CVE-2024-12852 | Happy Addons for Elementor [happy-elementor-addons] < 3.15.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 3.15.2 | 3.15.2 | 2025-01-07 | ✓ fixed in latest |
| CVE-2024-10538 | Happy Addons for Elementor [happy-elementor-addons] < 3.12.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 3.12.6 | 3.12.6 | 2024-11-11 | ✓ fixed in latest |
+ 37 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-48045 | Happy Addons for Elementor [happy-elementor-addons] < 3.12.4 | Missing Authorization | Medium 4.3 | < 3.12.4 | 3.12.4 | 2024-10-13 | ✓ fixed in latest |
| CVE-2024-47357 | Happy Addons for Elementor [happy-elementor-addons] < 3.12.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 3.12.1 | 3.12.1 | 2024-09-30 | ✓ fixed in latest |
| CVE-2024-8801 | Happy Addons for Elementor [happy-elementor-addons] < 3.12.3 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 4.3 | < 3.12.3 | 3.12.3 | 2024-09-23 | ✓ fixed in latest |
| CVE-2024-6627 | Happy Addons for Elementor [happy-elementor-addons] < 3.11.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.11.3 | 3.11.3 | 2024-07-26 | ✓ fixed in latest |
| CVE-2024-5790 | Happy Addons for Elementor [happy-elementor-addons] < 3.11.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.11.2 | 3.11.2 | 2024-06-28 | ✓ fixed in latest |
| CVE-2024-5041 | Happy Addons for Elementor [happy-elementor-addons] < 3.11.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.11.0 | 3.11.0 | 2024-05-30 | ✓ fixed in latest |
| CVE-2024-5347 | Happy Addons for Elementor [happy-elementor-addons] < 3.11.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.11.0 | 3.11.0 | 2024-05-30 | ✓ fixed in latest |
| CVE-2024-4865 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.10.9 | 3.10.9 | 2024-05-17 | ✓ fixed in latest |
| CVE-2024-5088 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.10.9 | 3.10.9 | 2024-05-17 | ✓ fixed in latest |
| CVE-2024-4478 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.8 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.10.8 | 3.10.8 | 2024-05-15 | ✓ fixed in latest |
| CVE-2024-4391 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.8 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.10.8 | 3.10.8 | 2024-05-15 | ✓ fixed in latest |
| CVE-2024-3890 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.10.7 | 3.10.7 | 2024-04-25 | ✓ fixed in latest |
| CVE-2024-3724 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.10.5 | 3.10.5 | 2024-04-19 | ✓ fixed in latest |
| CVE-2024-3891 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.10.6 | 3.10.6 | 2024-04-19 | ✓ fixed in latest |
| CVE-2024-32698 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 3.10.5 | 3.10.5 | 2024-04-19 | ✓ fixed in latest |
| CVE-2024-1387 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.5 | Missing Authorization | Medium 4.3 | < 3.10.5 | 3.10.5 | 2024-04-04 | ✓ fixed in latest |
| CVE-2024-2789 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.10.5 | 3.10.5 | 2024-04-04 | ✓ fixed in latest |
| CVE-2024-2786 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.10.4 | 3.10.4 | 2024-04-04 | ✓ fixed in latest |
| CVE-2024-2788 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.10.5 | 3.10.5 | 2024-04-04 | ✓ fixed in latest |
| CVE-2024-1498 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.10.4 | 3.10.4 | 2024-04-04 | ✓ fixed in latest |
| CVE-2024-2787 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.10.5 | 3.10.5 | 2024-04-04 | ✓ fixed in latest |
| CVE-2024-29108 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 3.10.2 | 3.10.2 | 2024-03-19 | ✓ fixed in latest |
| CVE-2024-1377 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.10.4 | 3.10.4 | 2024-03-06 | ✓ fixed in latest |
| CVE-2024-1366 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.10.4 | 3.10.4 | 2024-03-06 | ✓ fixed in latest |
| CVE-2024-0438 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.10.2 | 3.10.2 | 2024-02-13 | ✓ fixed in latest |
| CVE-2024-0838 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.10.2 | 3.10.2 | 2024-02-13 | ✓ fixed in latest |
| CVE-2024-24833 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.2 | Missing Authorization | Medium 4.3 | < 3.10.2 | 3.10.2 | 2024-02-02 | ✓ fixed in latest |
| — | Happy Addons for Elementor [happy-elementor-addons] < 3.10.1 | — | Unknown | < 3.10.1 | 3.10.1 | 2024-01-09 | ✓ fixed in latest |
| CVE-2023-6632 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.10.0 | 3.10.0 | 2024-01-05 | ✓ fixed in latest |
| CVE-2023-51676 | Happy Addons for Elementor [happy-elementor-addons] < 3.10.0 | Server-Side Request Forgery (SSRF) | Medium 4.9 | < 3.10.0 | 3.10.0 | 2023-12-27 | ✓ fixed in latest |
| CVE-2023-28989 | Happy Addons for Elementor [happy-elementor-addons] < 3.8.3 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 3.8.3 | 3.8.3 | 2023-03-29 | ✓ fixed in latest |
| CVE-2022-47150 | Happy Addons for Elementor [happy-elementor-addons] < 3.8.0 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 3.8.0 | 3.8.0 | 2023-03-21 | ✓ fixed in latest |
| CVE-2021-24292 | Happy Addons for Elementor [happy-elementor-addons] < 2.24.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.24.0 | 2.24.0 | 2021-04-26 | ✓ fixed in latest |
| — | Happy Addons for Elementor [happy-elementor-addons] < 3.21.1 | — | Unknown | < 3.21.1 | 3.21.1 | 0000-00-00 | ✓ fixed in latest |
| — | Happy Addons for Elementor [happy-elementor-addons] < 3.21.1 | — | Unknown | < 3.21.1 | 3.21.1 | 0000-00-00 | ✓ fixed in latest |
| — | Happy Addons for Elementor [happy-elementor-addons] < 3.20.8 | — | Unknown | < 3.20.8 | 3.20.8 | 0000-00-00 | ✓ fixed in latest |
| — | Happy Addons for Elementor [happy-elementor-addons] < 3.10.1 | — | Unknown | < 3.10.1 | 3.10.1 | — | ✓ fixed in latest |
How to fix it
Keep Happy Elementor Addons updated — 3.23.1 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Elementor Website Builder – more than just a page builder — 10000000+ active installs — 90/100 (7295)
- Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder — 2000000+ active installs — 98/100 (2525) — max PHP 8.4
- Essential Addons for Elementor – Popular Elementor Templates & Widgets — 1000000+ active installs — 98/100 (4110) — max PHP 8.4
- Starter Templates – AI-Powered Templates for Elementor & Gutenberg — 1000000+ active installs — 98/100 (4745) — max PHP 8.4
- ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor — 1000000+ active installs — 98/100 (2036) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.