CVE-2026-85006
Happy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button Widget
- State
- Published
- Severity
- 6.8 Medium
- Published
- Sep 23, 2026
- Updated
- Sep 23, 2026
- Reserved
- Sep 2, 2026
Description
The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser of anyone who views the page, including higher-privileged users reviewing the content, even though such users do not hold the unfiltered_html capability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.8 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
HappyAddons for ElementorUnknown |
|
References
- https://wpscan.com/vulnerability/50319e24-8ae8-40b8-9106-ed881359700e/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.