Stored Cross-Site Scripting in Happy Addons for Elementor Plugin

CVE-2024-3724

Summary

The Happy Addons for Elementor plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping within its Image Stack Group, Photo Stack, and Horizontal Timeline widgets. Authenticated attackers with contributor-level access can exploit this flaw to introduce arbitrary scripts into pages. When users access these manipulated pages, the scripts are executed, potentially compromising user data and site integrity. This vulnerability affects all versions of the plugin up to and including 3.10.4, underscoring the necessity for prompt updates and robust security practices.

References