Plugin security history

Happy Addons for Elementor Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 44 vulnerability records associated with Happy Addons for Elementor, published between 2021 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

44Total records

0Critical

0High

44Medium

0Low

0Informational

44Patched records

0Currently marked unpatched

2021-04-26First disclosure

2026-05-07Latest disclosure

42 of 44CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2021	1	1 records
2022	2	2 records
2023	2	2 records
2024	29	29 records
2025	5	5 records
2026	5	5 records

Severity Breakdown

Severity	Records	Share
Medium	44	100%

Vulnerability-Type Breakdown

Cross-Site Scripting

32 records72.7%

First: 2021. Latest: 2026.

Missing Authorization

6 records13.6%

First: 2022. Latest: 2026.

CSRF

2 records4.5%

First: 2022. Latest: 2023.

Information Disclosure

2 records4.5%

First: 2024. Latest: 2026.

Other

1 record2.3%

First: 2023. Latest: 2023.

SQL Injection

1 record2.3%

First: 2026. Latest: 2026.

Patch Status

Patched: 44
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.21.0
3.21.1
3.20.8
3.20.6
3.20.4
3.16.3
3.15.2
3.12.6
3.12.4
3.12.1
3.12.3
3.11.3
3.11.2
3.11.0
3.10.9
3.10.8
3.10.7
3.10.6
3.10.5
3.10.4
3.10.2
3.10.1
3.10.0
3.8.3
2.24.0

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.10.4`	Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	April 19, 2024	3.10.5	Medium
`*-3.10.3`	Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Stack Widget	April 4, 2024	3.10.4	Medium
`*-3.10.4`	Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title HTML Tag	April 4, 2024	3.10.5	Medium
`*-3.10.4`	Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendy	April 4, 2024	3.10.5	Medium
`*-3.10.4`	Happy Addons for Elementor <= 3.10.4 - Incorrect Authorization to Information Exposure	April 4, 2024	3.10.5	Medium
`*-3.10.4`	Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title HTML Tag	April 4, 2024	3.10.5	Medium
`*-3.10.4`	Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via title_tag	April 4, 2024	3.10.5	Medium
`*-3.10.3`	Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Meta Widget	March 6, 2024	3.10.4	Medium
`*-3.10.3`	Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Archive Title Widget	March 6, 2024	3.10.4	Medium
`*-3.10.1`	Happy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	February 13, 2024	3.10.2	Medium
`*-3.10.1`	Happy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	February 13, 2024	3.10.2	Medium
`*-3.10.1`	Happy Addons for Elementor <= 3.10.1 - Missing Authorization via add_row_actions	February 2, 2024	3.10.2	Medium
`*-3.10.0`	Happy Elementor Addons <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	January 9, 2024	3.10.1	Medium
`*-3.9.1.1`	Happy Addons for Elementor <= 3.9.1.1 - Reflected Cross-Site Scripting	January 5, 2024	3.10.0	Medium
`[*, 3.10.0)`	Happy Addons for Elementor <= 3.9.1.1 - Server Side Request Forgery	December 27, 2023	3.10.0	Medium
`*-3.8.2`	Happy Addons for Elementor <= 3.8.2 - Cross-Site Request Forgery via handle_optin_optout()	March 29, 2023	3.8.3	Medium
`*-3.8.2`	Appsero <= 1.2.1 - Missing Authorization	December 16, 2022	3.8.3	Medium
`*-3.8.2`	Appsero <= 1.2.0 - Cross-Site Request Forgery	December 14, 2022	3.8.3	Medium
`[*, 2.24.0)`	Happy Addons for Elementor <= 2.23.0 & Pro Version < 1.17.0 - Stored Cross-Site Scripting	April 26, 2021	2.24.0	Medium

Selected source records

Latest Records

MediumCVE-2026-25468

Happy Addons for Elementor <= 3.20.8 - Unauthenticated Information Exposure

Published: May 7, 2026

Affected versions: *-3.20.8
Patched versions: 3.21.0

Original Wordfence record

MediumCVE-2026-2917

Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter

Published: March 10, 2026

Affected versions: *-3.21.0
Patched versions: 3.21.1

Original Wordfence record

MediumCVE-2026-2918

Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions

Published: March 10, 2026

Affected versions: *-3.21.0
Patched versions: 3.21.1

Original Wordfence record

MediumCVE-2026-1210

Happy Addons for Elementor <= 3.20.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta Field

Published: February 2, 2026

Affected versions: *-3.20.7
Patched versions: 3.20.8

Original Wordfence record

MediumCVE-2025-68999

Happy Addons for Elementor <= 3.20.4 - Authenticated (Contributor+) SQL Injection

Published: January 23, 2026

Affected versions: *-3.20.4
Patched versions: 3.20.6

Original Wordfence record

MediumCVE-2025-14635

Happy Addons for Elementor <= 3.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS

Published: December 22, 2025

Affected versions: *-3.20.3
Patched versions: 3.20.4

Original Wordfence record

MediumCVE-2025-63077

Happy Addons for Elementor <= 3.20.3 - Missing Authorization

Published: December 4, 2025

Affected versions: *-3.20.3
Patched versions: 3.20.4

Original Wordfence record

MediumCVE-2024-5647

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library

Published: July 2, 2025

Affected versions: *-5.1.2
Patched versions: 5.1.3

Affected versions: *-4.27.1
Patched versions: 4.27.2

Affected versions: *-4.27.1
Patched versions: 4.27.2

Affected versions: *-3.6.0
Patched versions: 3.6.1

Affected versions: *-3.2.22
Patched versions: 3.2.23

Affected versions: *-3.12.2
Patched versions: 3.12.3

Affected versions: *-4.27.1
Patched versions: 4.27.2

Affected versions: *-2.5.52
Patched versions: 2.5.53

Affected versions: *-7.4.2
Patched versions: 7.4.3

Affected versions: *-2.0.5
Patched versions: Not supplied

Affected versions: *-2.2.14
Patched versions: 2.2.15

Affected versions: *-4.0.5
Patched versions: 4.0.6

Affected versions: *-3.4.9
Patched versions: Not supplied

Affected versions: *-6.0.4
Patched versions: 6.0.5

Original Wordfence record

Highest-Severity Records

MediumCVE-2025-68999

Happy Addons for Elementor <= 3.20.4 - Authenticated (Contributor+) SQL Injection

Published: January 23, 2026

Affected versions: *-3.20.4
Patched versions: 3.20.6

Original Wordfence record

MediumCVE-2024-1366

Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Archive Title Widget

Published: March 6, 2024

Affected versions: *-3.10.3
Patched versions: 3.10.4

Original Wordfence record

Medium

Happy Elementor Addons <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: January 9, 2024

Affected versions: *-3.10.0
Patched versions: 3.10.1

Original Wordfence record

MediumCVE-2025-14635

Happy Addons for Elementor <= 3.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS

Published: December 22, 2025

Affected versions: *-3.20.3
Patched versions: 3.20.4

Original Wordfence record

MediumCVE-2026-2918

Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions

Published: March 10, 2026

Affected versions: *-3.21.0
Patched versions: 3.21.1

Original Wordfence record

MediumCVE-2024-5088

Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: May 17, 2024

Affected versions: *-3.10.8
Patched versions: 3.10.9

Original Wordfence record

MediumCVE-2024-3890

Happy Addons for Elementor <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendly Widget

Published: April 25, 2024

Affected versions: *-3.10.6
Patched versions: 3.10.7

Original Wordfence record

MediumCVE-2024-0438

Happy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: February 13, 2024

Affected versions: *-3.10.1
Patched versions: 3.10.2

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory