The Happy Addons for Elementor plugin for WordPress is vulnerable to stored cross‑site scripting when the _elementor_data meta field is insufficiently sanitized and does not escape output. This flaw allows an authenticated user with Contributor level or higher to inject arbitrary JavaScript into a page that will execute every time any site visitor loads the page. The injected script can steal session cookies, deface content, or redirect users to malicious sites.

All installations of Happy Addons for Elementor version 3.20.7 and earlier are affected. The vulnerability exists within the plugin’s widget code and is present on all WordPress sites that use these versions of the add‑on.

The CVSS score of 6.4 indicates a medium severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation at this time. However, since the attack requires only authenticated access at the contributor level or higher, many sites might be able to attain the necessary privileges, and the stored nature of the flaw means that malicious payloads persist until an update or sanitization is applied.