CVE-2021-24292: Happy Addons for Elementor Free < 2.24.0 and Pro < 1.17.0 - Contributor+ Stored XSS

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-05-17 · updated 2026-06-17
Weakness: CWE-79

Description

The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.17.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method: The “Card” widget accepts a “title_tag” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request with the “heading_tag” set to “script”, and the actual “title” parameter set to JavaScript to be executed within the script tags added by the “heading_tag” parameter.

Affected products

weDevs Happy Addons for Elementor: before 1.17.0; before 2.24.0 — fixed in 1.17.0, 2.24.0

How to fix

Upgrade to a fixed version: weDevs Happy Addons for Elementor 1.17.0, 2.24.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-24292 or the next vulnerability affects your stack