Happy Addons for Elementor Vulnerability- Authenticated (Contributor+) Stored Cross-Site Scripting via Archive Title Widget – CVE-2024-1366 | WordPress Plugin Vulnerability Report

Plugin Name: Happy Addons for Elementor

Key Information:

  • Software Type: Plugin
  • Software Slug: happy-elementor-addons
  • Software Status: Active
  • Software Author: thehappymonster
  • Software Downloads: 6,213,235
  • Active Installs: 400,000
  • Last Updated: March 8, 2024
  • Patched Versions: 3.10.4
  • Affected Versions: <= 3.10.3

Vulnerability Details:

  • Name: Happy Addons for Elementor <= 3.10.3
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Archive Title Widget
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-1366
  • CVSS Score: 6.4
  • Publicly Published: March 6, 2024
  • Researcher: Wesley
  • Description: The vulnerability in Happy Addons for Elementor stems from insufficient input sanitization and output escaping within the 'archive_title_tag' attribute of the Archive Title widget. This flaw allows attackers with contributor-level permissions or higher to inject malicious scripts into web pages, posing a threat to website security and user safety.


The Happy Addons for Elementor plugin, widely used for enhancing Elementor page builder capabilities, has been found vulnerable in versions up to and including 3.10.3. This vulnerability, identified as an Authenticated Stored Cross-Site Scripting (XSS) risk via the Archive Title Widget, has been addressed in the latest patch, version 3.10.4.

Detailed Overview:

Wesley, a security researcher, discovered this critical vulnerability, which could be exploited by attackers with minimal permissions to compromise the security of WordPress websites using the plugin. By inserting harmful scripts into web pages, attackers could potentially gain unauthorized access to website data, manipulate content, or redirect users to malicious sites. The plugin developers have promptly released a patched version to mitigate this security risk.

Advice for Users:

  • Immediate Action: Update to version 3.10.4 immediately to secure your website from this vulnerability.
  • Check for Signs of Vulnerability: Regularly review your website for unexpected changes or content, which might indicate a compromise.
  • Alternate Plugins: Consider exploring other Elementor addons that provide similar functionalities as a temporary measure until you're confident in the patched version's security.
  • Stay Updated: Ensuring that all your WordPress plugins are up-to-date is crucial for maintaining a secure online presence.


The quick resolution of this vulnerability by the Happy Addons for Elementor developers emphasizes the critical nature of software updates in safeguarding digital assets. Users are strongly encouraged to upgrade to version 3.10.4 or later to protect their websites from potential security breaches.


In the bustling digital landscape where creativity meets functionality, the Elementor page builder has become a beacon for website designers and owners alike. Complementing this, Happy Addons for Elementor stands out as a valuable extension, enriching the Elementor ecosystem with its innovative widgets and features. Yet, the recent discovery of a security vulnerability, designated CVE-2024-1366, within Happy Addons for Elementor casts a shadow on its utility, highlighting the perennial battle between innovation and cybersecurity.

Plugin Overview:

Happy Addons for Elementor, developed by thehappymonster, is a plugin that enhances the capabilities of the Elementor page builder, boasting over 6 million downloads and 400,000 active installations. Its features are designed to empower users with additional creative tools and functionalities, making website design both accessible and dynamic.

Vulnerability Details:

CVE-2024-1366 exposes a critical flaw within the plugin's Archive Title Widget, specifically in the 'archive_title_tag' attribute, where insufficient input sanitization and output escaping allow attackers with contributor-level access to inject malicious scripts. Publicly disclosed by researcher Wesley on March 6, 2024, this vulnerability affects all plugin versions up to and including 3.10.3 and carries a CVSS score of 6.4, signifying a considerable security risk.

Risks and Potential Impacts:

The exploitation of this vulnerability could lead to unauthorized data access, website defacement, and compromise of user safety, eroding trust and potentially leading to significant reputational and financial damage, especially for small businesses reliant on their online presence.

Remediation and Prevention:

To mitigate the risks, users are urged to update to the patched version 3.10.4 immediately. Additionally, regular monitoring of website content and user activities is advisable to detect any signs of compromise early. For those seeking added security, exploring alternative plugins with similar functionality might provide peace of mind while ensuring continuity in operations.

Historical Vulnerabilities:

This is not the first time vulnerabilities have been identified in Happy Addons for Elementor, with 11 previous instances reported since April 26, 2021. Each incident underscores the importance of continuous vigilance and proactive security measures in the digital domain.

In conclusion, the discovery of CVE-2024-1366 within Happy Addons for Elementor serves as a crucial reminder of the ongoing need for diligence in maintaining website security. For small business owners juggling myriad responsibilities, this incident highlights the importance of automated security solutions, regular updates, and partnerships with reputable hosting and security providers. Staying abreast of vulnerabilities and adopting a proactive stance towards cybersecurity can protect your digital assets, ensuring the safety and reliability of your online presence in an ever-evolving threat landscape.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Happy Addons for Elementor Vulnerability- Authenticated (Contributor+) Stored Cross-Site Scripting via Archive Title Widget – CVE-2024-1366 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment