Security Alert Summary
A stored Cross-Site Scripting (XSS) vulnerability exists in the Happy Addons for Elementor plugin for WordPress that allows authenticated users with Contributor-level access and above to inject arbitrary JavaScript into pages via the _elementor_data meta field. Injected scripts execute whenever a user visits an infected page.
CVE Details
- CVE ID: CVE-2026-1210
- Affected component: The Happy Addons for Elementor plugin for WordPress
- Affected versions: All versions up to and including 3.20.7
- Published: February 3, 2026 at 7:16:12 AM
- Last modified: February 3, 2026 at 4:44:03 PM
- CVSS v3.1: Base Score 6.4 — MEDIUM
Vector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / Privileges / User Interaction:
- Authentication: Required (authenticated user)
- Privileges Required: Low (authenticated users such as Contributor-level and above)
- User Interaction: None
- Primary impact:
- Confidentiality: Low
- Integrity: Low
- Availability: None
- Weakness (CWE): CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting)
Technical Details
The vulnerability is a stored Cross-Site Scripting (XSS) issue caused by insufficient input sanitization and output escaping of the post meta field named _elementor_data. Authenticated users with Contributor-level access or higher can supply content that is saved to this meta field; because the plugin does not properly sanitize or escape that content on output, arbitrary scripts embedded in the meta value are rendered into pages and will execute in the context of any visitor who views the affected page.
The CVE description identifies the meta field _elementor_data as the injection point and attributes the root cause to missing input sanitization and output escaping. When a page containing the injected meta data is loaded, the browser executes the injected script code, which can perform actions available to client-side scripts in that context.
How This Could Impact Your Website
Consider a small team WordPress site with a site owner (administrator), internal staff (editors), and an external contractor or content contributor (Contributor). A contributor can create or edit content that includes malformed or malicious data in the _elementor_data meta field. When another user—such as an editor, administrator, or site visitor—loads the affected page, the injected script runs in their browser.
Practical consequences can include unauthorized modification of page content as displayed to visitors, exfiltration of information available in the browser context, and increased risk of targeted phishing or social engineering against staff and known contacts. Because the impact is described as low to confidentiality and integrity and none to availability, this behavior typically affects data viewed in users’ browsers and the integrity of displayed content rather than the site host or uptime directly.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry specifies affected versions up to and including 3.20.7; a fixed version is not specified in the CVE entry.)
- Review and reduce unnecessary user roles, especially Contributor and other roles that allow content creation.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior, including unexpected content changes on pages.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/happy-elementor-addons/tags/3.20.4/widgets/age-gate/widget.php#L2055
- https://plugins.trac.wordpress.org/browser/happy-elementor-addons/tags/3.20.4/widgets/age-gate/widget.php#L2120
- https://plugins.trac.wordpress.org/browser/happy-elementor-addons/tags/3.20.4/widgets/svg-draw/widget.php#L732
- https://plugins.trac.wordpress.org/browser/happy-elementor-addons/trunk/widgets/age-gate/widget.php#L2055
- https://plugins.trac.wordpress.org/browser/happy-elementor-addons/trunk/widgets/age-gate/widget.php#L2120
- https://plugins.trac.wordpress.org/browser/happy-elementor-addons/trunk/widgets/svg-draw/widget.php#L732
- https://plugins.trac.wordpress.org/changeset/3451894/happy-elementor-addons/trunk/widgets/svg-draw/widget.php?old=3312461&old_path=happy-elementor-addons%2Ftrunk%2Fwidgets%2Fsvg-draw%2Fwidget.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/df4b554a-0336-404c-b06c-2bc98c99997d?source=cve
