{"id":"CVE-2026-123473","kind":"vulnerability","aliases":["CVE-2026-123473"],"related":[],"title":"Happy Addons for Elementor: stored XSS lets attackers run scripts in pages","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.51.0.","summary":"Happy Addons for Elementor, a WordPress plugin by weDevs, has a stored cross-site scripting flaw in versions through 3.51.0. An attacker who can store input in the plugin can run scripts in other users' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","happy-elementor-addons","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Happy Addons for Elementor version in the WordPress plugins screen or `wp plugin get happy-elementor-addons --field=version`\n- Confirm whether the installed version is `3.51.0` or earlier","fix":"- Happy Addons for Elementor: unknown; the sources do not name a fixed version","status":"open","published_at":"2026-11-11T12:19:42+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","triaged_at":"2026-11-11T12:28:35+00:00","updated_at":"2026-11-11T12:28:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T12:28:35Z","model":"claude-haiku-5-5","output":{"fix":"- Happy Addons for Elementor: unknown; the sources do not name a fixed version","reach":"unknown","title":"Happy Addons for Elementor: stored XSS lets attackers run scripts in pages","impact":"medium","summary":"Happy Addons for Elementor, a WordPress plugin by weDevs, has a stored cross-site scripting flaw in versions through 3.51.0. An attacker who can store input in the plugin can run scripts in other users' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","happy-elementor-addons","elementor"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker scripts run in visitors' browsers, stealing sessions","analyst_note":"Confirm the fixed version and required privileges from the NVD entry or the weDevs plugin changelog at https://nvd.nist.gov/vuln/detail/CVE-2026-123473.","how_to_check":"- Check the installed Happy Addons for Elementor version in the WordPress plugins screen or `wp plugin get happy-elementor-addons --field=version`\n- Confirm whether the installed version is `3.51.0` or earlier","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Happy Addons for Elementor WordPress plugin at version 3.51.0 or earlier are exposed. The sources do not say which roles can store the input, so treat any site with the plugin as potentially affected. unknown for whether default configurations are vulnerable.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000757,"input_tokens":4560,"output_tokens":602,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123473':15A,18A '-2026':14A,17A '3.51.0':46B,98C 'addon':2A,23B,27B,79C,85C,92C 'affect':90C 'allow':86C 'attack':8A,48B 'browser':62B 'cross':39B,72C 'cross-sit':38B,71C 'cve':13A,16A 'elementor':4A,19B,22B,29B,81C,84C,94C 'flaw':42B 'generat':70C 'happi':1A,21B,26B,78C,83C,91C 'happy-elementor-addon':20B,82C 'improp':63C 'input':52B,66C 'issu':89C 'let':7A 'n/a':96C 'neutral':64C 'packag':24B 'page':12A,69C 'plugin':32B,55B 'run':9A,57B 'script':10A,41B,58B,74C 'site':40B,73C 'store':5A,37B,51B,87C 'user':61B 'version':44B 'vulner':75C 'web':68C 'wedev':34B,77C 'wordpress':25B,31B 'xss':6A 'xss.this':88C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Happy Addons for Elementor WordPress plugin at version 3.51.0 or earlier are exposed. The sources do not say which roles can store the input, so treat any site with the plugin as potentially affected. unknown for whether default configurations are vulnerable.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elementor","happyelementoraddons","medium","package","wordpress"],"campaign_type":null,"search_a":"'-123473':15A,18A '-2026':14A,17A 'addon':2A 'attack':8A 'cve':13A,16A 'elementor':4A 'happi':1A 'let':7A 'page':12A 'run':9A 'script':10A 'store':5A 'xss':6A","search_b":"'3.51.0':46B 'addon':23B,27B 'attack':48B 'browser':62B 'cross':39B 'cross-sit':38B 'elementor':19B,22B,29B 'flaw':42B 'happi':21B,26B 'happy-elementor-addon':20B 'input':52B 'packag':24B 'plugin':32B,55B 'run':57B 'script':41B,58B 'site':40B 'store':37B,51B 'user':61B 'version':44B 'wedev':34B 'wordpress':25B,31B","search_c":"'3.51.0':98C 'addon':79C,85C,92C 'affect':90C 'allow':86C 'cross':72C 'cross-sit':71C 'elementor':81C,84C,94C 'generat':70C 'happi':78C,83C,91C 'happy-elementor-addon':82C 'improp':63C 'input':66C 'issu':89C 'n/a':96C 'neutral':64C 'page':69C 'script':74C 'site':73C 'store':87C 'vulner':75C 'web':68C 'wedev':77C 'xss.this':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123473","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123473","severity":null,"published_at":"2026-11-11T12:19:42+00:00","modified_at":"2026-11-11T12:19:42+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","fetched_at":"2026-11-11T12:27:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}