CVE-2026-85006: Happy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button Widget
The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser of anyone who views the page, including higher-privileged users reviewing the content, even though such users do not hold the unfilteredhtml capability.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A user with Contributor-level access or higher can exploit it. The issue is relevant where untrusted or semi-trusted users can create or edit content using the affected Creative Button widget.
What does an attacker need to do to trigger the XSS?
The attacker must supply a crafted icon value in the Creative Button widget that injects an event-handler attribute. JavaScript runs when another user views the page containing the malicious widget.
Are administrators or other privileged users at risk?
Yes. Higher-privileged users can be affected if they view a page containing the injected payload, including while reviewing contributor content. Exploitation does not require the attacker to have the unfiltered_html capability.
What versions are affected?
Versions of Happy Addons for Elementor before 3.50.0 are affected.