Stored Cross-Site Scripting Vulnerability in Happy Addons for Elementor Plugin by WordPress

CVE-2026-1210

What is CVE-2026-1210?

The Happy Addons for Elementor plugin for WordPress is susceptible to stored cross-site scripting due to a lack of proper input sanitization and output escaping in the '_elementor_data' meta field. Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts into pages, which will execute when users access those manipulated pages. It is crucial for administrators to ensure they are using the latest version of the plugin to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References