The Happy Addons for Elementor plugin is vulnerable to stored cross‑site scripting through the ha_page_custom_js parameter because it does not properly sanitize or escape input. Authenticated users with Contributor level or higher can inject arbitrary JavaScript that will execute whenever any visitor views a page containing the injected script. This bypasses the intended administrator‑only restriction on custom JavaScript, allowing exploits such as credential theft, session hijacking, or site defacement.

All versions of Happy Addons for Elementor released by The Happy Monster up to and including version 3.20.3 are affected. The vulnerability exists in the Custom JS extension, which accepts input from the ha_page_custom_js parameter without proper sanitization.

The CVSS base score is 6.4, indicating moderate severity. The EPSS score is less than 1 %, suggesting the likelihood of exploitation is low. The vulnerability is not listed in CISA KEV. The attack requires authentication with at least Contributor privileges, so it is an authenticated stored XSS that can impact any organic traffic to the affected WordPress site.