Happy Addons CVE-2025-14635

Exploitation requires an authenticated WordPress account with Contributor-level access or above on a site running Happy Addons for Elementor version 3.20.3 or earlier; the attacker then supplies malicious script in the 'ha_page_custom_js' parameter, which the plugin fails to sanitize/escape and fails to restrict to Administrators as intended. The stored payload executes only when a user subsequently accesses the injected page, so the limiting factors are: (1) the attacker must already hold a trusted Contributor+ role (excluding anonymous attackers), and (2) a victim must view the affected page for the script to fire. Sites with no untrusted Contributor-or-higher users face substantially reduced real-world exposure.

This is a medium-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) that represents a moderate, not urgent, priority. The signals are internally consistent and point to limited real-world risk: the EPSS score is low at 0.29% (20th percentile), there is no CISA KEV listing, and no public exploit code is identified, so there is no public exploit identified at time of analysis. The CVSS vector confirms network vector and low complexity but requires privileges (PR:L), meaning an attacker must already hold a Contributor-level (or higher) authenticated account on the target site - a meaningful barrier that excludes anonymous internet-wide exploitation. The scope change (S:C) and the described privilege-boundary violation (a Contributor injecting Custom JS that is intended to be restricted to Administrators, executing in the browser of anyone who views the page) are the core of why this matters: it enables privilege escalation toward admin-context script execution. The low C:L/I:L/A:N impact reflects that this is script injection in a user's browser session rather than direct server compromise. No key data is conflicting; the main limiting factor - the requirement for a pre-existing trusted (Contributor+) account - is what keeps this from being a widespread, automatable threat. Prioritize patching on multi-author sites where untrusted users hold Contributor roles; deprioritize on single-admin sites.

An attacker who has obtained or been granted a Contributor-level WordPress account crafts a page and injects malicious JavaScript through the 'ha_page_custom_js' parameter, which the plugin fails to restrict to Administrators. When an administrator or other user previews or visits the page, the script executes in their browser session, potentially enabling session/cookie theft or admin-context actions. No public proof-of-concept exploit is identified at time of analysis, and the attack requires an authenticated Contributor account.