HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates vulnerabilities

Known security issues in the HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.

Plugin slug: happy-elementor-addons
Latest version: 3.50.1
Active installs: 400,000+
Known vulnerabilities: 48
Data updated: 2026-10-18 08:11 UTC

View on wordpress.org

Check your version

This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.

Fixed in version 3.50.1 (1)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.50.1
Vulnerability	Severity	CVSS	Affected versions	Published
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.50.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-104393 · Source	Medium	6.5	< 3.50.1	2026-09-30

Fixed in version 3.50.0 (2)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.50.0
Vulnerability	Severity	CVSS	Affected versions	Published
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-62080 · Source	Medium	6.5	< 3.50.0	2026-09-21
Happy Addons for Elementor <= 3.49.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-85006 · Source	Not rated	-	< 3.50.0	2026-05-07

Fixed in version 3.21.1 (2)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.21.1
Vulnerability	Severity	CVSS	Affected versions	Published
Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter CVE-2026-2917 · Source	Not rated	-	< 3.21.1	0000-00-00
Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions CVE-2026-2918 · Source	Not rated	-	< 3.21.1	0000-00-00

Fixed in version 3.21.0 (1)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.21.0
Vulnerability	Severity	CVSS	Affected versions	Published
Happy Addons for Elementor <= 3.20.8 - Unauthenticated Information Exposure CVE-2026-25468 · Source	Medium	5.3	< 3.21.0	2026-05-07

Fixed in version 3.20.8 (1)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.20.8
Vulnerability	Severity	CVSS	Affected versions	Published
Happy Addons for Elementor <= 3.20.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta Field CVE-2026-1210 · Source	Not rated	-	< 3.20.8	0000-00-00

Fixed in version 3.20.6 (1)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.20.6
Vulnerability	Severity	CVSS	Affected versions	Published
Happy Addons for Elementor <= 3.20.4 - Authenticated (Contributor+) SQL Injection CVE-2025-68999 · Source	High	8.5	< 3.20.6	2026-01-22

Fixed in version 3.20.4 (2)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.20.4
Vulnerability	Severity	CVSS	Affected versions	Published
Happy Addons for Elementor <= 3.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS CVE-2025-14635 · Source	Medium	6.4	< 3.20.4	2025-12-22
Happy Addons for Elementor <= 3.20.3 - Missing Authorization CVE-2025-63077 · Source	Medium	4.3	< 3.20.4	2025-12-04

Fixed in version 3.16.3 (1)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.16.3
Vulnerability	Severity	CVSS	Affected versions	Published
Happy Addons for Elementor <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-30766 · Source	Low	0.0	< 3.16.3	2025-03-27

Fixed in version 3.15.2 (1)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.15.2
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Happy Addons for Elementor Plugin <= 3.15.1 is vulnerable to Cross Site Scripting (XSS) CVE-2024-12852 · Source	Medium	6.4	< 3.15.2	2025-01-07

Fixed in version 3.12.6 (1)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.12.6
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Happy Addons for Elementor Plugin <= 3.12.5 is vulnerable to Cross Site Scripting (XSS) CVE-2024-10538 · Source	Medium	6.4	< 3.12.6	2024-11-11

Fixed in version 3.12.4 (1)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.12.4
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Happy Addons for Elementor Plugin <= 3.12.3 is vulnerable to Broken Access Control CVE-2024-48045 · Source	Medium	4.3	< 3.12.4	2024-10-13

Fixed in version 3.12.3 (2)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.12.3
Vulnerability	Severity	CVSS	Affected versions	Published
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library CVE-2024-5647 · Source	Medium	6.4	< 3.12.3	2025-07-02
Happy Addons for Elementor <= 3.12.2 - Authenticated (Contributor+) Sensitive Information Exposure CVE-2024-8801 · Source	Medium	4.3	< 3.12.3	2024-09-23

Fixed in version 3.12.1 (1)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.12.1
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Happy Addons for Elementor Plugin <= 3.12.0 is vulnerable to Cross Site Scripting (XSS) CVE-2024-47357 · Source	Medium	6.5	< 3.12.1	2024-09-30

Fixed in version 3.11.3 (1)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.11.3
Vulnerability	Severity	CVSS	Affected versions	Published
Happy Addons for Elementor <= 3.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via PDF View Widget CVE-2024-6627 · Source	Medium	5.4	< 3.11.3	2024-07-26

Fixed in version 3.11.2 (1)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.11.2
Vulnerability	Severity	CVSS	Affected versions	Published
Happy Addons for Elementor <= 3.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widget CVE-2024-5790 · Source	Medium	5.4	< 3.11.2	2024-06-28

Fixed in version 3.11.0 (2)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.11.0
Vulnerability	Severity	CVSS	Affected versions	Published
Happy Addons for Elementor <= 3.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion CVE-2024-5041 · Source	Medium	5.4	< 3.11.0	2024-05-30
WordPress Happy Addons for Elementor Plugin <= 3.10.9 is vulnerable to Cross Site Scripting (XSS) CVE-2024-5347 · Source	Medium	5.4	< 3.11.0	2024-05-30

Fixed in version 3.10.9 (2)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.10.9
Vulnerability	Severity	CVSS	Affected versions	Published
Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter CVE-2024-4865 · Source	Medium	5.4	< 3.10.9	2024-05-17
Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-5088 · Source	Medium	5.4	< 3.10.9	2024-05-17

Fixed in version 3.10.8 (2)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.10.8
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Happy Addons for Elementor Plugin <= 3.10.7 is vulnerable to Cross Site Scripting (XSS) CVE-2024-4478 · Source	Medium	5.4	< 3.10.8	2024-05-15
Happy Addons for Elementor Authenticated (Contributor+) Stored-XSS <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar Widget CVE-2024-4391 · Source	Medium	5.4	< 3.10.8	2024-05-15

Fixed in version 3.10.7 (1)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.10.7
Vulnerability	Severity	CVSS	Affected versions	Published
Happy Addons for Elementor <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendly Widget CVE-2024-3890 · Source	Medium	5.4	< 3.10.7	2024-04-25

Fixed in version 3.10.6 (1)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.10.6
Vulnerability	Severity	CVSS	Affected versions	Published
Happy Addons for Elementor <= 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags CVE-2024-3891 · Source	Medium	5.4	< 3.10.6	2024-04-19

Fixed in version 3.10.5 (6)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.10.5
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Happy Addons for Elementor Plugin <= 3.10.4 is vulnerable to Cross Site Scripting (XSS) CVE-2024-32698 · Source	Medium	6.5	< 3.10.5	2024-04-19
Happy Addons for Elementor <= 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group, Photo Stack, & Horizontal Timeline CVE-2024-3724 · Source	Medium	5.4	< 3.10.5	2024-04-19
Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendy CVE-2024-2789 · Source	Medium	5.4	< 3.10.5	2024-04-04
Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title HTML Tag CVE-2024-2788 · Source	Medium	5.4	< 3.10.5	2024-04-04
Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title HTML Tag CVE-2024-2787 · Source	Medium	5.4	< 3.10.5	2024-04-04
Happy Addons for Elementor <= 3.10.4 - Incorrect Authorization to Information Exposure CVE-2024-1387 · Source	Medium	4.3	< 3.10.5	2024-04-04

Fixed in version 3.10.4 (4)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.10.4
Vulnerability	Severity	CVSS	Affected versions	Published
Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via title_tag CVE-2024-2786 · Source	Medium	5.4	< 3.10.4	2024-04-04
Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Stack Widget CVE-2024-1498 · Source	Medium	5.4	< 3.10.4	2024-04-04
Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Meta Widget CVE-2024-1377 · Source	Medium	5.4	< 3.10.4	2024-03-06
Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Archive Title Widget CVE-2024-1366 · Source	Medium	5.4	< 3.10.4	2024-03-06

Fixed in version 3.10.2 (4)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.10.2
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Happy Addons for Elementor Plugin <= 3.10.1 is vulnerable to Cross Site Scripting (XSS) CVE-2024-29108 · Source	Medium	6.5	< 3.10.2	2024-03-19
Happy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-0438 · Source	Medium	5.4	< 3.10.2	2024-02-13
Happy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-0838 · Source	Medium	5.4	< 3.10.2	2024-02-13
Happy Addons for Elementor <= 3.10.1 - Missing Authorization via add_row_actions CVE-2024-24833 · Source	Medium	4.3	< 3.10.2	2024-02-02

Fixed in version 3.10.1 (2)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.10.1
Vulnerability	Severity	CVSS	Affected versions	Published
Happy Elementor Addons <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 3.10.1	2024-01-09
Happy Elementor Addons < 3.10.1 - Contributor+ Stored Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 3.10.1	-

Fixed in version 3.10.0 (2)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.10.0
Vulnerability	Severity	CVSS	Affected versions	Published
Happy Addons for Elementor <= 3.9.1.1 - Reflected Cross-Site Scripting CVE-2023-6632 · Source	Medium	6.1	< 3.10.0	2024-01-05
WordPress Happy Addons for Elementor Plugin <= 3.9.1.1 is vulnerable to Server Side Request Forgery (SSRF) CVE-2023-51676 · Source	Medium	4.9	< 3.10.0	2023-12-27

Fixed in version 3.8.3 (1)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.8.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Happy Addons for Elementor Plugin <= 3.8.2 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-28989 · Source	Medium	4.3	< 3.8.3	2023-03-29

Fixed in version 3.8.0 (1)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 3.8.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Happy Addons for Elementor Plugin <= 3.7.2 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2022-47150 · Source	Medium	4.3	< 3.8.0	2023-03-21

Fixed in version 2.24.0 (1)

HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates: Fixed in version 2.24.0
Vulnerability	Severity	CVSS	Affected versions	Published
Happy Addons for Elementor <= 2.23.0 & Pro Version < 1.17.0 - Stored Cross-Site Scripting CVE-2021-24292 · Source	Medium	5.4	< 2.24.0	2021-04-26

Check every plugin on your site automatically

Install the free Webforta Security plugin for WordPress and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.

Start free About the WordPress plugin

Sources and attribution

Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
CVE records are copyright The MITRE Corporation. CVE Terms of Use.
Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.