What’s Vulnerable › Vulnerabilities
CVE-2026-85006: Happy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button Widget
- Severity: medium (CVSS 6.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-23 · updated 2026-09-23
- Weakness: CWE-79
Description
The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser of anyone who views the page, including higher-privileged users reviewing the content, even though such users do not hold the unfiltered_html capability.
Affected products
- HappyAddons for Elementor: before 3.50.0 — fixed in 3.50.0
How to fix
Upgrade to a fixed version: HappyAddons for Elementor 3.50.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-85006 or the next vulnerability affects your stack