CVE-2025-14635

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14635", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-13T00:18:41.686Z", "datePublished": "2025-12-23T11:13:49.431Z", "dateUpdated": "2026-04-08T16:37:15.954Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:15.954Z"}, "affected": [{"vendor": "thehappymonster", "product": "Happy Addons for Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.20.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_page_custom_js' parameter in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, despite the intended role restriction of Custom JS to Administrators."}], "title": "Happy Addons for Elementor <= 3.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/16e7adef-68ab-4dd6-bd80-252622cfe705?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/happy-elementor-addons/tags/3.20.2/extensions/custom-js.php#L76"}, {"url": "https://plugins.trac.wordpress.org/browser/happy-elementor-addons/tags/3.20.2/extensions/custom-js.php#L60"}, {"url": "https://plugins.trac.wordpress.org/changeset/3421733/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "timeline": [{"time": "2025-12-13T00:37:07.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-22T22:08:35.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-23T14:49:24.670142Z", "id": "CVE-2025-14635", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-23T14:50:59.327Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14635", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-23T14:49:24.670142Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-23T14:50:46.784Z"}}], "cna": {"title": "Happy Addons for Elementor <= 3.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS", "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "thehappymonster", "product": "Happy Addons for Elementor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.20.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-13T00:37:07.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-22T22:08:35.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/16e7adef-68ab-4dd6-bd80-252622cfe705?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/happy-elementor-addons/tags/3.20.2/extensions/custom-js.php#L76"}, {"url": "https://plugins.trac.wordpress.org/browser/happy-elementor-addons/tags/3.20.2/extensions/custom-js.php#L60"}, {"url": "https://plugins.trac.wordpress.org/changeset/3421733/"}], "descriptions": [{"lang": "en", "value": "The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_page_custom_js' parameter in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, despite the intended role restriction of Custom JS to Administrators."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:15.954Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14635", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:37:15.954Z", "dateReserved": "2025-12-13T00:18:41.686Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-23T11:13:49.431Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Happy Addons for Elementor", "vendor": "thehappymonster", "versions": [{"lessThanOrEqual": "3.20.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_page_custom_js' parameter in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, despite the intended role restriction of Custom JS to Administrators."}, {"lang": "es", "value": "El plugin Happy Addons for Elementor para WordPress es vulnerable a Cross-site Scripting almacenado (XSS) a trav\u00e9s del par\u00e1metro \u2019ha_page_custom_js\u2019 en todas las versiones hasta la versi\u00f3n 3.20.3 incluida debido a una sanitizaci\u00f3n insuficiente de la entrada y a una fuga de salida. Esto permite a atacantes autenticados, con nivel de acceso de Contribuidor o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada, a pesar de la restricci\u00f3n de rol prevista de Custom JS a Administradores."}], "id": "CVE-2025-14635", "lastModified": "2026-10-19T22:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14635", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-23T14:49:24.670142Z", "version": "2.0.3"}}]}, "published": "2025-12-23T12:15:44.890", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/happy-elementor-addons/tags/3.20.2/extensions/custom-js.php#L60"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/happy-elementor-addons/tags/3.20.2/extensions/custom-js.php#L76"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3421733/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/16e7adef-68ab-4dd6-bd80-252622cfe705?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T15:59:53.729411+00:00", "value": {"mitigation_remediation": ["Update to Happy Addons for Elementor version 3.20.4 or later, which removes the unsafe input handling in the Custom JS extension.", "If an update cannot be applied immediately, revoke Contributor or higher roles from users who do not need to use Custom JS, or downgrade the Custom JS feature to Administrator only by adjusting plugin settings or code.", "Manually inspect and sanitize or delete any stored custom JavaScript code that may contain malicious content in existing pages."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "All versions of Happy Addons for Elementor released by The Happy Monster up to and including version 3.20.3 are affected. The vulnerability exists in the Custom JS extension, which accepts input from the ha_page_custom_js parameter without proper sanitization.", "description_and_impact": "The Happy Addons for Elementor plugin is vulnerable to stored cross\u2011site scripting through the ha_page_custom_js parameter because it does not properly sanitize or escape input. Authenticated users with Contributor level or higher can inject arbitrary JavaScript that will execute whenever any visitor views a page containing the injected script. This bypasses the intended administrator\u2011only restriction on custom JavaScript, allowing exploits such as credential theft, session hijacking, or site defacement.", "risk_and_exploitability": "The CVSS base score is 6.4, indicating moderate severity. The EPSS score is less than 1\u202f%, suggesting the likelihood of exploitation is low. The vulnerability is not listed in CISA KEV. The attack requires authentication with at least Contributor privileges, so it is an authenticated stored XSS that can impact any organic traffic to the affected WordPress site."}}}}, "created": "2025-12-23T22:39:40.346046+00:00", "updated": "2026-04-22T16:00:12.110844+00:00", "vendors": ["happymonster", "happymonster$PRODUCT$happy_addons_for_elementor", "wordpress", "wordpress$PRODUCT$wordpress"]}