What is the CVSS score of EUVD-2026-94256?

EUVD-2026-94256 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Happy Addons EUVD-2026-94256

| CVE-2026-104393 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-10-07 Patchstack

GHSA-hfvf-4g77-qmfv

WordPress XSS Happy Addons For Elementor Wordpress Plugin Wedevs

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

Authenticated low-privilege account needed to store the payload (PR:L) and a victim must view the page (UI:R); script runs in the victim browser so scope changes (S:C) with Low C/I/A.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Oct 07, 2026 - 09:52 vuln.today

CVE Published

Oct 07, 2026 - 09:16 cve.org

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.0.

AnalysisAI

Stored cross-site scripting in the Happy Addons for Elementor WordPress plugin (versions through 3.50.0) allows an authenticated low-privilege user to plant JavaScript that runs in the browser of any higher-privileged user who views the affected page. Rated CVSS 6.5 (Medium), the flaw requires an existing contributor-level account plus victim interaction, so it is not exploitable by anonymous remote attackers against a default installation. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated attacker with a lower-privilege account on the WordPress site (CVSS PR:L - consistent with the contributor/author role that can access Happy Addons for Elementor editing features), and it requires victim user interaction (UI:R): a privileged user must load the page containing the stored payload for the script to execute. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a stored cross-site scripting (CWE-79) vulnerability in the Happy Addons for Elementor WordPress plugin, rated CVSS 6.5 (Medium). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch or fixed version is identified in the available data, so the primary action is to check the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/happy-elementor-addons/vulnerability/wordpress-happy-addons-for-elementor-plugin-3-50-0-cross-site-scripting-xss-vulnerability?_s_id=cve and the WordPress plugin repository for a release newer than 3.50.0, then upgrade immediately once one is published. … Detailed patch versions, workarounds, and compensating controls in full report.