A reflected Cross Site Scripting vulnerability exists in WordPress Happy Addons for Elementor plugin versions up to 3.23.1. The flaw allows an attacker to inject and execute arbitrary script code in the browsers of users who view a page that includes content edited with the plugin, potentially leading to session hijacking, defacement, or theft of user data.

The Leevio Happy Addons for Elementor plugin is affected. Any WordPress site running versions 3.23.1 or older is vulnerable. The issue is fixed in version 3.50.0 and higher.

The CVSS score of 6.5 classifies the vulnerability as moderate. No EPSS score is available, and it is not listed in the CISA KEV catalog. The likely attack vector is an attacker crafting a payload that is accepted by the plugin’s unvalidated input fields, which will then be reflected in the page output without proper escaping. Because the flaw requires the attacker to embed script tags or similar payload in content managed by the plugin, execution depends on a user viewing the affected page. Successful exploitation would allow the attacker to run arbitrary JavaScript in the context of the site’s domain.