CVE-2026-1210: Happy Addons for Elementor XSS Vulnerability

CVE-2026-1210 Overview

The Happy Addons for Elementor plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the _elementor_data meta field. This security flaw affects all versions up to and including 3.20.7 and stems from insufficient input sanitization and output escaping within the plugin's widget functionality.

This vulnerability enables authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into WordPress pages. These malicious scripts execute whenever any user accesses the compromised page, creating a persistent attack vector that can affect site visitors, administrators, and other authenticated users.

Critical Impact

Authenticated attackers can persistently inject malicious JavaScript into WordPress pages, potentially leading to session hijacking, credential theft, defacement, or further compromise of site visitors.

Affected Products

• Happy Addons for Elementor plugin versions up to and including 3.20.7
• WordPress sites running vulnerable versions of the Happy Addons for Elementor plugin
• Age Gate widget component (widgets/age-gate/widget.php)
• SVG Draw widget component (widgets/svg-draw/widget.php)

Discovery Timeline

• February 3, 2026 - CVE-2026-1210 published to NVD
• February 3, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1210

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists due to improper handling of user-supplied input within the Happy Addons for Elementor plugin. The vulnerability specifically affects the _elementor_data meta field, which stores widget configuration and content data for Elementor pages.

When users with Contributor-level privileges or above create or edit content using affected widgets (Age Gate and SVG Draw), the plugin fails to properly sanitize input before storing it in the database and fails to escape output when rendering the content. This creates a persistent XSS condition where malicious scripts are stored server-side and executed client-side whenever the affected page is viewed.

The vulnerability requires authentication, meaning attackers must have at least Contributor-level access to exploit it. However, once the malicious payload is injected, it executes for all users viewing the compromised page, including administrators with higher privilege levels.

Root Cause

The root cause of CVE-2026-1210 is insufficient input sanitization and output escaping in the widget rendering functionality. Specifically, the affected widget files (age-gate/widget.php and svg-draw/widget.php) do not properly validate and escape user-controlled data before including it in the HTML output.

WordPress provides sanitization functions such as wp_kses(), esc_html(), esc_attr(), and esc_js() that should be used to prevent XSS attacks. The vulnerable code paths fail to apply these protections consistently, allowing specially crafted input containing JavaScript payloads to pass through and be rendered as executable code in users' browsers.

Attack Vector

The attack is network-based and requires the attacker to have authenticated access to the WordPress installation with at least Contributor-level permissions. The attack sequence involves:

1. An attacker authenticates to WordPress with Contributor or higher privileges
2. The attacker creates or edits a page/post using Elementor with the Happy Addons plugin
3. Using the Age Gate or SVG Draw widgets, the attacker injects malicious JavaScript through the _elementor_data meta field
4. The malicious script is stored in the WordPress database
5. When any user (including administrators) views the affected page, the malicious script executes in their browser context

The vulnerability is particularly concerning because it allows lower-privileged users to potentially compromise higher-privileged accounts through session hijacking or credential theft.

The vulnerability manifests in the Age Gate widget around lines 2055 and 2120, and in the SVG Draw widget around line 732. For technical implementation details, refer to the WordPress Plugin Widget Code and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-1210

Indicators of Compromise

• Unusual JavaScript code present in Elementor page data or _elementor_data meta fields
• Unexpected script tags or event handlers in Age Gate or SVG Draw widget configurations
• Browser console errors or unusual network requests from WordPress pages
• Reports of unexpected behavior or redirects when viewing specific pages
• Audit log entries showing Contributor-level users modifying pages with Elementor widgets

Detection Strategies

• Review wp_postmeta table entries for _elementor_data containing suspicious JavaScript patterns such as <script>, javascript:, onerror=, or onload=
• Implement Web Application Firewall (WAF) rules to detect and block XSS payloads in POST requests to WordPress admin endpoints
• Deploy content security policy headers to mitigate the impact of successful XSS exploitation
• Use WordPress security plugins that scan for malicious code in database content

Monitoring Recommendations

• Enable detailed logging for WordPress user activities, particularly page creation and editing by Contributor-level accounts
• Monitor for unusual JavaScript execution patterns using browser developer tools or security extensions
• Implement real-time alerting for changes to pages containing Age Gate or SVG Draw widgets
• Regularly audit user accounts with Contributor or higher privileges to ensure they are legitimate

How to Mitigate CVE-2026-1210

Immediate Actions Required

• Update Happy Addons for Elementor plugin to the latest patched version immediately
• Audit all existing pages using Age Gate and SVG Draw widgets for potentially injected malicious content
• Review and restrict Contributor-level access on WordPress installations until patches are applied
• Implement Content Security Policy headers to reduce XSS impact

Patch Information

A security fix has been released for Happy Addons for Elementor. The patch addresses the insufficient input sanitization and output escaping in the affected widget files. For details on the specific code changes, refer to the WordPress Plugin Change Log.

To apply the patch:

1. Log into your WordPress admin dashboard
2. Navigate to Plugins → Installed Plugins
3. Locate "Happy Addons for Elementor" and click "Update Now"
4. Verify the update completed successfully and the version is higher than 3.20.7

Workarounds

• Temporarily disable the Happy Addons for Elementor plugin if immediate patching is not possible
• Restrict Contributor-level user permissions to prevent them from creating or editing pages with Elementor
• Implement server-side input validation rules to strip potentially malicious JavaScript patterns from widget data
• Deploy a Web Application Firewall with XSS protection rules targeting the affected endpoints

# Example: Temporarily disable the plugin via WP-CLI
wp plugin deactivate happy-elementor-addons

# Verify plugin status
wp plugin status happy-elementor-addons

# After patching, re-enable the plugin
wp plugin activate happy-elementor-addons

# Update to latest version via WP-CLI
wp plugin update happy-elementor-addons