VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates security & vulnerabilities

happy-elementor-addons— active installsLast vulnerability Nov 11, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
51Known vulnerabilities
  • Critical0
  • High0
  • Medium51
  • Low0
Vulnerabilities per year
2021: 1 vulnerability1212022: 2 vulnerabilities2222023: 2 vulnerabilities2232024: 29 vulnerabilities29242025: 5 vulnerabilities5252026: 12 vulnerabilities1226

All HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates vulnerabilities

HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.51.0Update to 3.51.3
CVE-2026-123473
Medium4.3Missing Authorization
≤3.51.0Update to 3.51.3
CVE-2026-124269
Medium4.3Missing Authorization
≤3.50.1Update to 3.51.0
CVE-2026-109891
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.50.1Update to 3.51.0
CVE-2026-116850
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.50.0Update to 3.50.1
CVE-2026-104393
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.23.1Update to 3.50.0
CVE-2026-62080
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.49.0Update to 3.50.0
CVE-2026-85006
Medium5.3Unauthenticated Information Exposure
≤3.20.8Update to 3.21.0
CVE-2026-25468
Medium5.4Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter
≤3.21.0Update to 3.21.1
CVE-2026-2917
Medium6.4Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions
≤3.21.0Update to 3.21.1
CVE-2026-2918
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta Field
≤3.20.7Update to 3.20.8
CVE-2026-1210
Medium6.5Authenticated (Contributor+) SQL Injection
≤3.20.4Update to 3.20.6
CVE-2025-68999
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS
≤3.20.3Update to 3.20.4
CVE-2025-14635
Medium4.3Missing Authorization
≤3.20.3Update to 3.20.4
CVE-2025-63077
Medium6.4Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
≤6.0.4Update to 6.0.5
CVE-2024-5647
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.16.2Update to 3.16.3
CVE-2025-30766
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.15.1Update to 3.15.2
CVE-2024-12852
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison
≤3.12.5Update to 3.12.6
CVE-2024-10538
Medium5.4Missing Authorization
≤3.12.3Update to 3.12.4
CVE-2024-48045
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.12.0Update to 3.12.1
CVE-2024-47357
Medium4.3Authenticated (Contributor+) Sensitive Information Exposure
≤3.12.2Update to 3.12.3
CVE-2024-8801
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via PDF View Widget
≤3.11.2Update to 3.11.3
CVE-2024-6627
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widget
≤3.11.1Update to 3.11.2
CVE-2024-5790
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation Widget
≤3.10.9Update to 3.11.0
CVE-2024-5347
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion
≤3.10.9Update to 3.11.0
CVE-2024-5041
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter
≤3.10.8Update to 3.10.9
CVE-2024-4865
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.10.8Update to 3.10.9
CVE-2024-5088
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar Widget
≤3.10.7Update to 3.10.8
CVE-2024-4391
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group Widget
≤3.10.7Update to 3.10.8
CVE-2024-4478
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Calendly Widget
≤3.10.6Update to 3.10.7
CVE-2024-3890
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags
≤3.10.5Update to 3.10.6
CVE-2024-3891
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group, Photo Stack, & Horizontal Timeline
≤3.10.4Update to 3.10.5
CVE-2024-3724
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.10.4Update to 3.10.5
CVE-2024-32698
Medium5.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via title_tag
≤3.10.4Update to 3.10.5
CVE-2024-2786
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Stack Widget
≤3.10.3Update to 3.10.4
CVE-2024-1498
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title HTML Tag
≤3.10.4Update to 3.10.5
CVE-2024-2787
Medium4.3Incorrect Authorization to Information Exposure
≤3.10.4Update to 3.10.5
CVE-2024-1387
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Calendy
≤3.10.4Update to 3.10.5
CVE-2024-2789
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title HTML Tag
≤3.10.4Update to 3.10.5
CVE-2024-2788
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Archive Title Widget
≤3.10.3Update to 3.10.4
CVE-2024-1366
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Author Meta Widget
≤3.10.3Update to 3.10.4
CVE-2024-1377
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.10.1Update to 3.10.2
CVE-2024-0838
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.10.1Update to 3.10.2
CVE-2024-0438
Medium4.3Missing Authorization via add_row_actions
≤3.10.1Update to 3.10.2
CVE-2024-24833
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.10.0Update to 3.10.1
—
Medium6.1Reflected Cross-Site Scripting
≤2.9.1.1Update to 2.10.0
CVE-2023-6632
Medium5.4Server Side Request Forgery
<3.10.0Update to 3.10.0
CVE-2023-51676
Medium4.3Cross-Site Request Forgery via handle_optin_optout()
≤3.8.2Update to 3.8.3
CVE-2023-28989
Medium4.3Missing Authorization
≤3.6.0Update to 3.6.1
—
Medium4.3Cross-Site Request Forgery
≤3.6.0Update to 3.6.1
CVE-2022-47150
Medium6.4Stored Cross-Site Scripting
<1.17.0Update to 1.17.0
CVE-2021-24292

HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates: common questions

Does HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates have known vulnerabilities?

Yes. VulnCrest Radar lists 51 known vulnerabilities in HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates: 51 medium. At least one is not fixed in the latest version.

How do I check which version of HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates vulnerability?

CVE-2026-123473, published Nov 11, 2026: HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.51.0 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates vulnerability listed in CISA KEV?

No. None of the known HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?