CVE-2026-104393: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in weDevs Happy Addons for Elementor

The vulnerability CVE-2026-104393 in weDevs Happy Addons for Elementor is a stored cross-site scripting (XSS) flaw caused by improper input neutralization during web page generation. This allows an attacker with low privileges to inject malicious scripts that execute in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts. The issue affects all versions from initial release through 3.50.0.

Successful exploitation can lead to execution of arbitrary scripts in the context of other users, potentially allowing partial disclosure of information, modification of data, and disruption of availability. The attack requires user interaction and low privileges, limiting but not eliminating risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with input handling and restrict privileges where possible. Monitor vendor channels for updates and apply patches promptly once released.