CVE-2025-63077
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Happy Addons for Elementor plugin (versions up to and including 3.20.3) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This may allow unauthorized access to functions or data.
Risk Assessment
An unauthenticated or low-privileged user could perform actions reserved for higher privileges, potentially leading to content modification or data exposure on the WordPress site.
Recommendation
Update the Happy Addons for Elementor plugin to a version later than 3.20.3. Review and verify user permissions on the WordPress site.
Other vulnerabilities in Happy Addons for Elementor
See all- CVE-2026-62080Medium
Happy Addons for Elementor plugin version 3.23.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by contributors, allowing injection of malicious scripts.
- CVE-2026-104393Medium
Stored XSS vulnerability in the Happy Addons for Elementor plugin by weDevs. Improper input neutralization during page generation allows persistent execution of malicious scripts.
Original NVD description (English source)
Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through <= 3.20.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS