CVE-2026-116850 in Happy Addons Plugin
Summary
by MITRE • 10/29/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/29/2026
The identified security flaw represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this vulnerability manifests as a Stored XSS within the weDevs Happy Addons for Elementor plugin, affecting versions ranging from n/a through 3.50.1. Unlike reflected XSS attacks where malicious scripts are executed via manipulated URLs, stored XSS involves the persistence of the attack payload on the target server. In this context, an attacker can inject malicious JavaScript code into fields or inputs that are subsequently rendered by the application without proper sanitization. When other users view the affected page, their browsers execute the embedded script in the security context of the vulnerable website, leading to a severe compromise of user data and session integrity.
The technical root cause lies in the failure of the application to adequately sanitize or encode user-supplied input before it is included in dynamic web content. Elementor-based plugins often handle rich text inputs, form submissions, or widget configurations where users can enter arbitrary strings. If the Happy Addons plugin fails to apply appropriate output encoding mechanisms such as HTML entity encoding or context-aware escaping for JavaScript contexts, any script tags, event handlers like onerror or onload, or other executable code fragments submitted by a user will be preserved in the database and rendered directly into the DOM of subsequent page loads. This lack of input validation allows an attacker to bypass standard browser security policies because the malicious content originates from a trusted domain, effectively tricking users into trusting the compromised site.
The operational impact of this vulnerability is significant due to its persistent nature. Once the payload is stored on the server, it affects every user who accesses the infected page, potentially leading to widespread compromise within an organization or community using the affected plugin. Attackers can utilize this vector to steal sensitive information such as session cookies, authentication tokens, and personal data entered into forms. Furthermore, the vulnerability enables attackers to perform actions on behalf of victims, including changing account settings, making unauthorized transactions, or defacing web pages. In enterprise environments, this could serve as an initial foothold for more advanced attacks, such as pivoting to internal systems if session cookies provide access to administrative interfaces or other authenticated services.
To mitigate this risk, immediate action is required by administrators and developers associated with the affected software. The primary remediation strategy involves upgrading the Happy Addons plugin to a version that includes patches for input validation and output encoding issues, specifically versions newer than 3.50.1 if available from the vendor. For environments where an upgrade is not immediately feasible, temporary mitigations should be implemented at the web server or application firewall level. This can include configuring Web Application Firewalls WAF rules to detect and block common XSS payloads such as script tags and event handlers in HTTP request parameters. Additionally, developers must ensure that all user inputs are strictly validated against expected formats and that outputs are encoded according to their context within HTML documents. Implementing Content Security Policy CSP headers with strict directives can also help mitigate the impact by restricting the sources from which scripts can be loaded or executed, thereby reducing the effectiveness of any successfully injected malicious code.