WordPress happy-elementor-addons has 25 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2024-1387 | The Happy Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to insufficient authorization on the du | medium | 4.3 | <=3.10.4 | – |
| CVE-2024-0438 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wrapper link parameter in the Age G | medium | 6.4 | <3.10.2 | 3.10.2 |
| CVE-2023-6632 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via DOM in all versions up to and includ | medium | 6.1 | <3.10.0 or <2.10.0 | 3.10.0 |
| CVE-2024-3724 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Stack Group, Photo S | medium | 6.4 | <=3.10.4 | – |
| CVE-2024-1498 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Photo Stack Widget in all | medium | 6.4 | <=3.10.3 | – |
| CVE-2024-0838 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the side image URL parameter in the Age | medium | 6.4 | <=3.10.2 | – |
| CVE-2024-2786 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, | medium | 5.4 | <=3.10.4 | – |
| CVE-2024-3891 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tags in widgets in all versions up | medium | 6.4 | <=3.10.5 | – |
| CVE-2024-8801 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3. | medium | 4.3 | <3.12.3 | 3.12.3 |
| CVE-2024-4865 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up | medium | 6.4 | <=3.10.8 | – |
| CVE-2024-1366 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘archive_title_tag’ attribute of th | medium | 6.4 | <=3.10.3 | – |
| CVE-2024-5088 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up | medium | 6.4 | <=3.10.8 | – |
| CVE-2024-2788 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Title HTML Tag in all versions | medium | 6.4 | <=3.10.4 | – |
| CVE-2024-1377 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author_meta_tag’ attribute of the | medium | 6.4 | <=3.10.3 | – |
| CVE-2024-2787 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title HTML Tag in all versions | medium | 6.4 | <=3.10.4 | – |
| CVE-2024-2789 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Calendy widget in all vers | medium | 6.4 | <=3.10.4 | – |
| CVE-2024-3890 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Calendly widget in all versions up | medium | 6.4 | <=3.10.5 | – |
| CVE-2024-4478 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Stack Group widget in all ver | medium | 6.4 | <=3.10.7 | – |
| CVE-2024-5347 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'arrow' attribute within the plugin | medium | 6.4 | <3.11.0 | 3.11.0 |
| CVE-2024-5790 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's | medium | 6.4 | <3.11.2 | 3.11.2 |
| CVE-2024-6627 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's PDF View widget in all ver | medium | 6.4 | <=3.11.2 | – |
| CVE-2024-4391 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Event Calendar widget in a | medium | 6.4 | <=3.10.7 | – |
| CVE-2024-5041 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ha-ia-content-button’ parameter in | medium | 6.4 | <=3.10.9 | – |
| CVE-2024-12852 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_cmc_text' parameter of the Happ | medium | 6.4 | <3.15.2 | 3.15.2 |
| CVE-2024-10538 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the before_label parameter in the Image | medium | 6.4 | <3.12.6 | 3.12.6 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked