Live › vulnerability › CVE-2026-116850
Happy Addons for Elementor, a WordPress plugin from weDevs, has a stored cross-site scripting flaw that affects versions through 3.50.1. An attacker who can store content on the site can make scripts run in other visitors' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running the Happy Addons for Elementor WordPress plugin through version 3.50.1 are affected. The stored-XSS flaw needs content to be stored on the site, so the level of access an attacker needs is unknown from the sources. Sites without this plugin can skip it.
No product ranges from the sources yet.
happy-elementor-addons) in the WordPress plugins screen or the plugin header.happy-elementor-addons): a fixed version later than 3.50.1; the exact version is unknown.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-116850")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.