The vulnerability in Happy Addons for Elementor allows an authenticated user with Contributor or higher privileges to modify the display conditions of any published "ha_library" template. The missing object‑level authorization and lack of capability checks on AJAX actions let the attacker modify conditions and inject unescaped attribute values into the template rendering. This results in a stored Cross‑Site Scripting (XSS) that is triggered when an administrator opens the Template Conditions panel, enabling the attacker to execute arbitrary JavaScript with the administrator’s privileges. The weakness corresponds to CWE‑639 (Access Control Weakness).

All installations of the Happy Addons for Elementor plugin running versions up to and including 3.21.0 are affected. The plugin is distributed by thehappymonster and the vulnerability exists in the core condition‑management code of the plugin.

The CVSS score is 6.4, indicating a medium severity, while the EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, marking it as a low probability but potentially impactful issue. Exploitation requires web‑based access to the site’s admin area and the victim merely needs any user that holds the Contributor role or higher to perform the AJAX request. The attack vector is authenticated and does not require additional privileges beyond the standard Contributor capability. If the attacker can observe an administrator viewing the conditions panel, the XSS payload will execute immediately.