CVE-2026-2918 affects the Happy Addons for Elementor plugin for WordPress through insecure direct object references in the `ha_condition_update` and `ha_get_current_condition` AJAX actions. The vulnerability arises because the `validate_reqeust()` method incorrectly uses `current_user_can('edit_posts', $template_id)` instead of the correct `current_user_can('edit_post', $template_id)`, failing to enforce object-level authorization. Furthermore, the `ha_get_current_condition` action lacks any capability check. Authenticated users with Contributor or higher privileges can exploit this to modify display conditions of any published `ha_library` template. The `cond_to_html()` function outputs these conditions into HTML attributes without proper escaping, enabling stored cross-site scripting via injected event handler attributes that execute JavaScript when an administrator views the Template Conditions panel. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact.

An attacker with Contributor-level or higher access can bypass authorization controls to modify display conditions of published templates, potentially altering site behavior. The stored XSS vulnerability allows execution of arbitrary JavaScript in the context of an administrator viewing the Template Conditions panel, which could lead to session hijacking or further compromise. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only. Monitor updates from thehappymonster for an official patch addressing the authorization bypass and stored XSS issues. Avoid administrators accessing the Template Conditions panel from untrusted environments to reduce risk of stored XSS exploitation.