Stored Cross-Site Scripting Vulnerability in Happy Addons for Elementor Plugin

CVE-2025-14635

What is CVE-2025-14635?

The Happy Addons for Elementor plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input validation and output escaping on the 'ha_page_custom_js' parameter. This flaw allows authenticated attackers with Contributor-level access and higher to inject malicious scripts into pages, which subsequently execute when other users access these compromised pages. Despite the plugin's design intention to restrict Custom JS functionality to Administrators, the vulnerability bypasses these controls, posing significant security risks to affected WordPress sites.

References