UNKNOWN NVD

CVE-2026-85006

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML att

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser of anyone who views the page, including higher-privileged users reviewing the content, even though such users do not hold the unfiltered_html capability.

References

https://wpscan.com/vulnerability/50319e24-8ae8-40b8-9106-ed881359700e/

Published: 2026-09-23 · Source: NVD · Feed updated: 2026-09-23

This unknown severity vulnerability was published on 2026-09-23 via NVD.

vulnfeed aggregates 4195 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.