Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2025-63077

WordPress Happy Addons for Elementor plugin <= 3.20.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through <= 3.20.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Elementor Happymonster Wordpress
Products
Elementor Happy Addons For Elementor Wordpress
CVE-2025-68999

WordPress Happy Addons for Elementor plugin <= 3.20.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Blind SQL Injection.This issue affects Happy Addons for Elementor: from n/a through <= 3.20.4.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Happymonster Wordpress
Products
Happy Addons For Elementor Wordpress
CVE-2025-14635

Happy Addons for Elementor <= 3.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_page_custom_js' parameter in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, despite the intended role restriction of Custom JS to Administrators.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Happymonster Wordpress
Products
Happy Addons For Elementor Wordpress
CVE-2026-1210

Happy Addons for Elementor <= 3.20.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta Field

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_elementor_data' meta field in all versions up to, and including, 3.20.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Happymonster Wordpress
Products
Happy Addons For Elementor Wordpress