{
 "id": "WPSEC-2026-1808",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1808/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1808/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1808/index.md",
 "title": "HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.50.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Custom JS",
 "description": "The HappyAddons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the page custom JS setting (ha_page_custom_js) in all versions up to, and including, 3.50.1, due to the restriction on this setting being enforced only in the Elementor document save filter. Other writes to the _elementor_page_settings post meta, such as the WordPress REST API post meta field, were not checked, and the stored script was output on the front end as an inline script without checking that its author may write unfiltered HTML. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
 "plugin": {
  "slug": "happy-elementor-addons",
  "name": "HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates",
  "full_name": "HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates",
  "wordpress_org": "https://wordpress.org/plugins/happy-elementor-addons/",
  "advisories_url": "https://wpsec.com/vuln/plugin/happy-elementor-addons/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/happy-elementor-addons"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.51.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.51.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.51.0",
 "remediation": "Update to 3.51.0 or later.",
 "fix_released": "2026-10-27T05:51:42+00:00",
 "published": "2026-10-28T06:42:37+00:00",
 "updated": "2026-10-27T13:40:36.228417+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1808/",
  "https://plugins.svn.wordpress.org/happy-elementor-addons/tags/3.51.0/",
  "https://wordpress.org/plugins/happy-elementor-addons/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/happy-elementor-addons",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-28"
 }
}