# HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates

> HappyAddons packs Header Footer Builder, Megamenu, Single Post, Archive Page, & 500+ Ready Templates into one powerful Elementor Addons plugin.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 10:34 UTC.

## Facts (WordPress.org)

- Slug: `happy-elementor-addons`
- Author: Leevio
- Version: 3.51.3
- Active installs: 400,000+
- Last update: 2026-11-10 (4 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.8, PHP 8.1
- Tags: elementor, elementor addons, elementor widget, header footer builder, mega menu
- Page: https://wordpress.org/plugins/happy-elementor-addons/

## Checks (against WordPress 7.1.4)

- OK: Updated 4 days ago.
- OK: Tested with WordPress 7.1.
- FLAG: Requires PHP 8.1 or newer, above WordPress's own minimum (PHP 7.4).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Slows pages ↔ Speeds up, Locked in ↔ Portable, Breaking ↔ Smooth, Steep ↔ Easy, Inaccessible ↔ Accessible, Behind ↔ Current.

## Known vulnerabilities

- 2026-11-11 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.51.0). CVE-2026-123473, https://www.wordfence.com/threat-intel/vulnerabilities/id/61fe349c-a66c-466f-b1a0-efa443f2548c?source=api-prod
- 2026-11-11 MEDIUM: Missing Authorization (up to 3.51.0). CVE-2026-124269, https://www.wordfence.com/threat-intel/vulnerabilities/id/d167c871-93f4-46b4-9e4e-6d2c8a1ba88f?source=api-prod
- 2026-10-29 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.50.1). CVE-2026-116850, https://www.wordfence.com/threat-intel/vulnerabilities/id/9019ff9f-6a2b-4617-8fe4-e860b9d38f9e?source=api-prod
- 2026-10-29 MEDIUM: Missing Authorization (up to 3.50.1). CVE-2026-109891, https://www.wordfence.com/threat-intel/vulnerabilities/id/6b41380b-5028-4230-a380-e46871e2eede?source=api-prod
- 2026-10-07 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.50.0). CVE-2026-104393, https://www.wordfence.com/threat-intel/vulnerabilities/id/2b60b304-a128-4598-bf5f-b07b5e39cf29?source=api-prod
- 2026-09-30 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.23.1). CVE-2026-62080, https://www.wordfence.com/threat-intel/vulnerabilities/id/e7331416-0f52-4790-a494-95c3f528b99c?source=api-prod
- 2026-09-23 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.49.0). CVE-2026-85006, https://www.wordfence.com/threat-intel/vulnerabilities/id/982b8880-650f-49a6-9877-c28ee35e9e1d?source=api-prod
- 2026-05-07 MEDIUM: Unauthenticated Information Exposure (up to 3.20.8). CVE-2026-25468, https://www.wordfence.com/threat-intel/vulnerabilities/id/cd6dcfe2-91c4-42c1-ada4-91c6f25c4690?source=api-prod
- 2026-03-10 MEDIUM: Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions (up to 3.21.0). CVE-2026-2918, https://www.wordfence.com/threat-intel/vulnerabilities/id/1a3fe49b-cc0d-4b29-aae5-46307483b8d4?source=api-prod
- 2026-03-10 MEDIUM: Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter (up to 3.21.0). CVE-2026-2917, https://www.wordfence.com/threat-intel/vulnerabilities/id/9234b1ce-032f-487d-b60a-f80c78373238?source=api-prod
- 2026-02-02 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta Field (up to 3.20.7). CVE-2026-1210, https://www.wordfence.com/threat-intel/vulnerabilities/id/df4b554a-0336-404c-b06c-2bc98c99997d?source=api-prod
- 2026-01-23 MEDIUM: Authenticated (Contributor+) SQL Injection (up to 3.20.4). CVE-2025-68999, https://www.wordfence.com/threat-intel/vulnerabilities/id/ce3cb2e9-6491-4b93-bd98-1ece39171b0c?source=api-prod
- 2025-12-22 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS (up to 3.20.3). CVE-2025-14635, https://www.wordfence.com/threat-intel/vulnerabilities/id/16e7adef-68ab-4dd6-bd80-252622cfe705?source=api-prod
- 2025-12-04 MEDIUM: Missing Authorization (up to 3.20.3). CVE-2025-63077, https://www.wordfence.com/threat-intel/vulnerabilities/id/d295f424-8e18-4a32-8d96-94ce931d125b?source=api-prod
- 2025-07-02 MEDIUM: Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library (up to 3.12.2). WF-dae80fc2-3076-4a32-876d-5df1c62de9bd-6, https://www.wordfence.com/threat-intel/vulnerabilities/id/dae80fc2-3076-4a32-876d-5df1c62de9bd?source=api-prod
- 2025-03-27 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.16.2). CVE-2025-30766, https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f1ea27-463f-477e-b3c0-691ed84e34a4?source=api-prod
- 2025-01-07 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.15.1). CVE-2024-12852, https://www.wordfence.com/threat-intel/vulnerabilities/id/e60d4528-2ec5-4a4b-be77-0fc012c13720?source=api-prod
- 2024-11-11 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison (up to 3.12.5). CVE-2024-10538, https://www.wordfence.com/threat-intel/vulnerabilities/id/fd192a52-ae12-4706-b3ea-aa69f7393bb8?source=api-prod
- 2024-10-13 MEDIUM: Missing Authorization (up to 3.12.3). CVE-2024-48045, https://www.wordfence.com/threat-intel/vulnerabilities/id/1fc447bc-841c-443f-9949-a0d852762fd9?source=api-prod
- 2024-09-30 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.12.0). CVE-2024-47357, https://www.wordfence.com/threat-intel/vulnerabilities/id/a63d6a64-aaba-4744-a372-89e1c0ce00df?source=api-prod
- 2024-09-23 MEDIUM: Authenticated (Contributor+) Sensitive Information Exposure (up to 3.12.2). CVE-2024-8801, https://www.wordfence.com/threat-intel/vulnerabilities/id/9f1078b8-f458-46a6-9982-e8d2d1d1b73b?source=api-prod
- 2024-07-26 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via PDF View Widget (up to 3.11.2). CVE-2024-6627, https://www.wordfence.com/threat-intel/vulnerabilities/id/5bfe0a05-6bf9-4acc-bf9d-05079c3b3664?source=api-prod
- 2024-06-28 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widget (up to 3.11.1). CVE-2024-5790, https://www.wordfence.com/threat-intel/vulnerabilities/id/6d1b948a-7a7e-4bdf-af1d-559f34d4baa3?source=api-prod
- 2024-05-30 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation Widget (up to 3.10.9). CVE-2024-5347, https://www.wordfence.com/threat-intel/vulnerabilities/id/415a7201-bdff-4342-9e06-ce0e500cdc7c?source=api-prod
- 2024-05-30 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion (up to 3.10.9). CVE-2024-5041, https://www.wordfence.com/threat-intel/vulnerabilities/id/fb037c9f-5d20-46f6-b1ff-34b9d192bad2?source=api-prod
- 2024-05-17 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.10.8). CVE-2024-5088, https://www.wordfence.com/threat-intel/vulnerabilities/id/203ab09f-7344-4cab-86bf-0c1ec545d78f?source=api-prod
- 2024-05-17 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter (up to 3.10.8). CVE-2024-4865, https://www.wordfence.com/threat-intel/vulnerabilities/id/2fdf2020-ad80-44c3-89b6-fc2ba067cd33?source=api-prod
- 2024-05-15 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group Widget (up to 3.10.7). CVE-2024-4478, https://www.wordfence.com/threat-intel/vulnerabilities/id/c7243f40-5cca-475a-bb27-44fab965bb0e?source=api-prod
- 2024-05-15 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar Widget (up to 3.10.7). CVE-2024-4391, https://www.wordfence.com/threat-intel/vulnerabilities/id/e75f7e1a-f3bb-4b24-bf04-b83d0e572551?source=api-prod
- 2024-04-25 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Calendly Widget (up to 3.10.6). CVE-2024-3890, https://www.wordfence.com/threat-intel/vulnerabilities/id/22e4eb2a-2c2b-4f4f-821e-8d2d7e558364?source=api-prod
- 2024-04-19 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.10.4). CVE-2024-32698, https://www.wordfence.com/threat-intel/vulnerabilities/id/79de2a90-225a-4d3e-b511-d12ede2cface?source=api-prod
- 2024-04-19 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group, Photo Stack, & Horizontal Timeline (up to 3.10.4). CVE-2024-3724, https://www.wordfence.com/threat-intel/vulnerabilities/id/826483d7-948d-46c4-890c-71001b03847c?source=api-prod
- 2024-04-19 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags (up to 3.10.5). CVE-2024-3891, https://www.wordfence.com/threat-intel/vulnerabilities/id/ade7f391-3824-4d0b-8718-f7995170a43d?source=api-prod
- 2024-04-04 MEDIUM: Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via title_tag (up to 3.10.4). CVE-2024-2786, https://www.wordfence.com/threat-intel/vulnerabilities/id/4688c1ee-335c-4adb-bd68-894ff34d001d?source=api-prod
- 2024-04-04 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title HTML Tag (up to 3.10.4). CVE-2024-2788, https://www.wordfence.com/threat-intel/vulnerabilities/id/73e4ec2f-f4e1-469d-a4b7-5a10d44b7a2f?source=api-prod
- 2024-04-04 MEDIUM: Incorrect Authorization to Information Exposure (up to 3.10.4). CVE-2024-1387, https://www.wordfence.com/threat-intel/vulnerabilities/id/aff10d5a-a2d0-461a-b52b-a25b647eaab4?source=api-prod
- 2024-04-04 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Calendy (up to 3.10.4). CVE-2024-2789, https://www.wordfence.com/threat-intel/vulnerabilities/id/bb93853b-a6e0-42d1-8b10-b391984603f2?source=api-prod
- 2024-04-04 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title HTML Tag (up to 3.10.4). CVE-2024-2787, https://www.wordfence.com/threat-intel/vulnerabilities/id/ea3daad1-74a1-44be-b7ed-b58b806da614?source=api-prod
- 2024-04-04 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Stack Widget (up to 3.10.3). CVE-2024-1498, https://www.wordfence.com/threat-intel/vulnerabilities/id/f43e1eed-09f8-44b3-b6fa-d0344f331dd7?source=api-prod
- 2024-03-19 MEDIUM: Cross-site Scripting (up to 3.10.1). CVE-2024-29108, https://patchstack.com/database/vulnerability/happy-elementor-addons/wordpress-happy-addons-for-elementor-plugin-3-10-1-cross-site-scripting-xss-vulnerability?_s_id=cve
- 2024-03-06 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Archive Title Widget (up to 3.10.3). CVE-2024-1366, https://www.wordfence.com/threat-intel/vulnerabilities/id/08208cb1-2d57-49f9-8ac7-b59caa0cf5fa?source=api-prod
- 2024-03-06 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Author Meta Widget (up to 3.10.3). CVE-2024-1377, https://www.wordfence.com/threat-intel/vulnerabilities/id/b61eb8b7-0d89-47ef-831c-1772d01e2c85?source=api-prod
- 2024-02-13 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.10.1). CVE-2024-0438, https://www.wordfence.com/threat-intel/vulnerabilities/id/267641fe-7490-4b8f-bb39-9531eefa2c30?source=api-prod
- 2024-02-13 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.10.1). CVE-2024-0838, https://www.wordfence.com/threat-intel/vulnerabilities/id/d55bab2a-5e2e-440e-b4fa-03853679ba22?source=api-prod
- 2024-02-02 MEDIUM: Missing Authorization via add_row_actions (up to 3.10.1). CVE-2024-24833, https://www.wordfence.com/threat-intel/vulnerabilities/id/1b25df18-dd9a-4b24-8187-283d5f3f334e?source=api-prod
- 2024-01-09 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.10.0). WF-1453815d-4e28-41ec-9aa4-4fd2899c619a, https://www.wordfence.com/threat-intel/vulnerabilities/id/1453815d-4e28-41ec-9aa4-4fd2899c619a?source=api-prod
- 2024-01-05 MEDIUM: Reflected Cross-Site Scripting (up to 3.9.1.1). CVE-2023-6632, https://www.wordfence.com/threat-intel/vulnerabilities/id/06ef69f0-34d3-4389-8a81-a4d9922f1468?source=api-prod
- 2023-12-27 MEDIUM: Server Side Request Forgery (before 3.10.0). CVE-2023-51676, https://www.wordfence.com/threat-intel/vulnerabilities/id/64ae36a3-d102-4d51-b685-395283155101?source=api-prod
- 2023-03-29 MEDIUM: Cross-Site Request Forgery via handle_optin_optout() (up to 3.8.2). CVE-2023-28989, https://www.wordfence.com/threat-intel/vulnerabilities/id/27439d44-f2ff-4c20-965f-25d12c83781c?source=api-prod
- 2022-12-16 MEDIUM: Missing Authorization (up to 3.8.2). WF-84003388-c47c-41db-8d2d-4643aa375a89-24, https://www.wordfence.com/threat-intel/vulnerabilities/id/84003388-c47c-41db-8d2d-4643aa375a89?source=api-prod
- 2022-12-14 MEDIUM: Cross-Site Request Forgery (up to 3.8.2). WF-e869800a-6fbc-4a1a-97fd-92ecbf3305ff-24, https://www.wordfence.com/threat-intel/vulnerabilities/id/e869800a-6fbc-4a1a-97fd-92ecbf3305ff?source=api-prod
- 2021-05-17 MEDIUM: Cross-Site Scripting (before 2.24.0). CVE-2021-24292, https://wpscan.com/vulnerability/0f20e098-8106-451f-9448-d35a79f03077
- 2021-04-26 MEDIUM: Stored Cross-Site Scripting (before 2.24.0). WF-f8ec4c5e-fb24-4b74-9ed8-0a9060625aba-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/f8ec4c5e-fb24-4b74-9ed8-0a9060625aba?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=happy-elementor-addons · HTML: https://todaywp.com/plugins/happy-elementor-addons