Plugin security history

Happy Addons for Elementor Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 44 vulnerability records associated with Happy Addons for Elementor, published between 2021 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

44Total records

0Critical

0High

44Medium

0Low

0Informational

44Patched records

0Currently marked unpatched

2021-04-26First disclosure

2026-05-07Latest disclosure

42 of 44CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2021	1	1 records
2022	2	2 records
2023	2	2 records
2024	29	29 records
2025	5	5 records
2026	5	5 records

Severity Breakdown

Severity	Records	Share
Medium	44	100%

Vulnerability-Type Breakdown

Cross-Site Scripting

32 records72.7%

First: 2021. Latest: 2026.

Missing Authorization

6 records13.6%

First: 2022. Latest: 2026.

CSRF

2 records4.5%

First: 2022. Latest: 2023.

Information Disclosure

2 records4.5%

First: 2024. Latest: 2026.

Other

1 record2.3%

First: 2023. Latest: 2023.

SQL Injection

1 record2.3%

First: 2026. Latest: 2026.

Patch Status

Patched: 44
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.21.0
3.21.1
3.20.8
3.20.6
3.20.4
3.16.3
3.15.2
3.12.6
3.12.4
3.12.1
3.12.3
3.11.3
3.11.2
3.11.0
3.10.9
3.10.8
3.10.7
3.10.6
3.10.5
3.10.4
3.10.2
3.10.1
3.10.0
3.8.3
2.24.0

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.20.8`	Happy Addons for Elementor <= 3.20.8 - Unauthenticated Information Exposure	May 7, 2026	3.21.0	Medium
`*-3.21.0`	Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter	March 10, 2026	3.21.1	Medium
`*-3.21.0`	Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions	March 10, 2026	3.21.1	Medium
`*-3.20.7`	Happy Addons for Elementor <= 3.20.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta Field	February 2, 2026	3.20.8	Medium
`*-3.20.4`	Happy Addons for Elementor <= 3.20.4 - Authenticated (Contributor+) SQL Injection	January 23, 2026	3.20.6	Medium
`*-3.20.3`	Happy Addons for Elementor <= 3.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS	December 22, 2025	3.20.4	Medium
`*-3.20.3`	Happy Addons for Elementor <= 3.20.3 - Missing Authorization	December 4, 2025	3.20.4	Medium
`*-3.12.2`	Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library	July 2, 2025	3.12.3	Medium
`*-3.16.2`	Happy Addons for Elementor <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	March 27, 2025	3.16.3	Medium
`*-3.15.1`	Happy Addons for Elementor <= 3.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	January 7, 2025	3.15.2	Medium
`*-3.12.5`	Happy Addons for Elementor <= 3.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison	November 11, 2024	3.12.6	Medium
`*-3.12.3`	Happy Addons for Elementor <= 3.12.3 - Missing Authorization	October 13, 2024	3.12.4	Medium
`*-3.12.0`	Happy Addons for Elementor <= 3.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	September 30, 2024	3.12.1	Medium
`*-3.12.2`	Happy Addons for Elementor <= 3.12.2 - Authenticated (Contributor+) Sensitive Information Exposure	September 23, 2024	3.12.3	Medium
`*-3.11.2`	Happy Addons for Elementor <= 3.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via PDF View Widget	July 26, 2024	3.11.3	Medium
`*-3.11.1`	Happy Addons for Elementor <= 3.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widget	June 28, 2024	3.11.2	Medium
`*-3.10.9`	Happy Addons for Elementor <= 3.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation Widget	May 30, 2024	3.11.0	Medium
`*-3.10.9`	Happy Addons for Elementor <= 3.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion	May 30, 2024	3.11.0	Medium
`*-3.10.8`	Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter	May 17, 2024	3.10.9	Medium
`*-3.10.8`	Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 17, 2024	3.10.9	Medium
`*-3.10.7`	Happy Addons for Elementor Authenticated (Contributor+) Stored-XSS <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar Widget	May 15, 2024	3.10.8	Medium
`*-3.10.7`	Happy Addons for Elementor <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group Widget	May 15, 2024	3.10.8	Medium
`*-3.10.6`	Happy Addons for Elementor <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendly Widget	April 25, 2024	3.10.7	Medium
`*-3.10.5`	Happy Addons for Elementor <= 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags	April 19, 2024	3.10.6	Medium
`*-3.10.4`	Happy Addons for Elementor <= 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group, Photo Stack, & Horizontal Timeline	April 19, 2024	3.10.5	Medium

Selected source records

Latest Records

MediumCVE-2026-25468

Happy Addons for Elementor <= 3.20.8 - Unauthenticated Information Exposure

Published: May 7, 2026

Affected versions: *-3.20.8
Patched versions: 3.21.0

Original Wordfence record

MediumCVE-2026-2917

Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter

Published: March 10, 2026

Affected versions: *-3.21.0
Patched versions: 3.21.1

Original Wordfence record

MediumCVE-2026-2918

Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions

Published: March 10, 2026

Affected versions: *-3.21.0
Patched versions: 3.21.1

Original Wordfence record

MediumCVE-2026-1210

Happy Addons for Elementor <= 3.20.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta Field

Published: February 2, 2026

Affected versions: *-3.20.7
Patched versions: 3.20.8

Original Wordfence record

MediumCVE-2025-68999

Happy Addons for Elementor <= 3.20.4 - Authenticated (Contributor+) SQL Injection

Published: January 23, 2026

Affected versions: *-3.20.4
Patched versions: 3.20.6

Original Wordfence record

MediumCVE-2025-14635

Happy Addons for Elementor <= 3.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS

Published: December 22, 2025

Affected versions: *-3.20.3
Patched versions: 3.20.4

Original Wordfence record

MediumCVE-2025-63077

Happy Addons for Elementor <= 3.20.3 - Missing Authorization

Published: December 4, 2025

Affected versions: *-3.20.3
Patched versions: 3.20.4

Original Wordfence record

MediumCVE-2024-5647

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library

Published: July 2, 2025

Affected versions: *-5.1.2
Patched versions: 5.1.3

Affected versions: *-4.27.1
Patched versions: 4.27.2

Affected versions: *-4.27.1
Patched versions: 4.27.2

Affected versions: *-3.6.0
Patched versions: 3.6.1

Affected versions: *-3.2.22
Patched versions: 3.2.23

Affected versions: *-3.12.2
Patched versions: 3.12.3

Affected versions: *-4.27.1
Patched versions: 4.27.2

Affected versions: *-2.5.52
Patched versions: 2.5.53

Affected versions: *-7.4.2
Patched versions: 7.4.3

Affected versions: *-2.0.5
Patched versions: Not supplied

Affected versions: *-2.2.14
Patched versions: 2.2.15

Affected versions: *-4.0.5
Patched versions: 4.0.6

Affected versions: *-3.4.9
Patched versions: Not supplied

Affected versions: *-6.0.4
Patched versions: 6.0.5

Original Wordfence record

Highest-Severity Records

MediumCVE-2025-68999

Happy Addons for Elementor <= 3.20.4 - Authenticated (Contributor+) SQL Injection

Published: January 23, 2026

Affected versions: *-3.20.4
Patched versions: 3.20.6

Original Wordfence record

MediumCVE-2024-1366

Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Archive Title Widget

Published: March 6, 2024

Affected versions: *-3.10.3
Patched versions: 3.10.4

Original Wordfence record

Medium

Happy Elementor Addons <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: January 9, 2024

Affected versions: *-3.10.0
Patched versions: 3.10.1

Original Wordfence record

MediumCVE-2025-14635

Happy Addons for Elementor <= 3.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS

Published: December 22, 2025

Affected versions: *-3.20.3
Patched versions: 3.20.4

Original Wordfence record

MediumCVE-2026-2918

Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions

Published: March 10, 2026

Affected versions: *-3.21.0
Patched versions: 3.21.1

Original Wordfence record

MediumCVE-2024-5088

Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: May 17, 2024

Affected versions: *-3.10.8
Patched versions: 3.10.9

Original Wordfence record

MediumCVE-2024-3890

Happy Addons for Elementor <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendly Widget

Published: April 25, 2024

Affected versions: *-3.10.6
Patched versions: 3.10.7

Original Wordfence record

MediumCVE-2024-0438

Happy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: February 13, 2024

Affected versions: *-3.10.1
Patched versions: 3.10.2

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory