CVE-2024-4478

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Stack Group widget in all versions up to, and including, 3.10.7 due to insufficient input sanitization and output escaping on user supplied 'tooltip_position' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79
• CWE-79

• https://plugins.trac.wordpress.org/browser/happy-elementor-addons/tags/3.10.7/widgets/image-stack-group/widget.php#L611Product
• https://plugins.trac.wordpress.org/changeset/3083138/#file584Patch
• https://wordpress.org/plugins/happy-elementor-addons/#developersRelease Notes
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c7243f40-5cca-475a-bb27-44fab965bb0e?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/happy-elementor-addons/tags/3.10.7/widgets/image-stack-group/widget.php#L611Product
• https://plugins.trac.wordpress.org/changeset/3083138/#file584Patch
• https://wordpress.org/plugins/happy-elementor-addons/#developersRelease Notes
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c7243f40-5cca-475a-bb27-44fab965bb0e?source=cveThird Party Advisory

Published

May 16, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-44771BigId PrivacyPortal v179 is vulnerable to Cross Site Scripti…6.1
• CVE-2024-44775kmqtt v0.2.7 is vulnerable to Denial of Service (DoS) due to…7.5
• CVE-2024-44776An Open Redirect vulnerability in the page parameter of vTig…6.1
• CVE-2024-44777A reflected cross-site scripting (XSS) vulnerability in the …9.6
• CVE-2024-44778A reflected cross-site scripting (XSS) vulnerability in the …9.6
• CVE-2024-44779A reflected cross-site scripting (XSS) vulnerability in the …9.6
• CVE-2024-44786Incorrect access control in Meabilis CMS 1.0 allows attacker…7.5
• CVE-2024-4479The Jeg Elementor Kit plugin for WordPress is vulnerable to …5.4
• CVE-2024-44793A cross-site scripting (XSS) vulnerability in the component …6.1
• CVE-2024-44794A cross-site scripting (XSS) vulnerability in the component …6.1
• CVE-2024-44795A cross-site scripting (XSS) vulnerability in the component …6.1
• CVE-2024-44796A cross-site scripting (XSS) vulnerability in the component …6.1