CVE-2026-85006 in HappyAddons for Elementor Plugin
Summary
by MITRE • 09/23/2026
The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser of anyone who views the page, including higher-privileged users reviewing the content, even though such users do not hold the unfiltered_html capability.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in HappyAddons for Elementor prior to version 3.50.0 represents a significant security flaw within the WordPress ecosystem, specifically targeting the plugin's button widget functionality. This issue stems from an insufficient sanitization and validation of user-supplied input when rendering icon values associated with buttons. The core technical failure lies in the lack of proper escaping mechanisms before these values are embedded directly into HTML attributes during page generation. By failing to encode special characters or validate against a strict allowlist, the application inadvertently creates a vector for Cross-Site Scripting attacks. This architectural oversight allows malicious actors to inject arbitrary JavaScript code through specifically crafted icon parameters, bypassing standard WordPress security filters that typically restrict such actions based on user capabilities.
From an operational perspective, this vulnerability enables stored or reflected cross-site scripting depending on how the content is persisted and served. The most critical aspect of this flaw is its impact on users with Contributor-level access and above. In typical WordPress configurations, these roles are granted elevated privileges to manage content but are explicitly denied the unfiltered_html capability, which prevents them from injecting raw HTML or script tags through standard post editors. However, because HappyAddons processes icon values without adequate sanitization before outputting them into attributes like onclick or onmouseover, it effectively circumvents this restriction. An attacker with Contributor-level access can craft a button widget where the icon field contains malicious JavaScript payloads rather than valid icon identifiers. When other users view the page containing this compromised content, their browsers execute the injected scripts in the context of the site's domain.
The consequences of such an exploit are severe and multifaceted. Attackers can perform session hijacking by stealing administrator cookies or authentication tokens displayed on the screen, leading to full account compromise. They may also deface websites by manipulating DOM elements, redirect users to phishing sites designed to steal credentials from visitors, or deploy malware through drive-by download techniques if combined with other vulnerabilities. The risk is particularly acute because it affects higher-privileged users who review content. An administrator viewing a draft created by a Contributor could inadvertently trigger the malicious script, thereby compromising their own session and potentially gaining unauthorized control over the entire WordPress installation. This undermines the principle of least privilege inherent in role-based access controls within WordPress.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as a Cross-Site Scripting weakness. It also maps to MITRE ATT&CK technique T1059, specifically subtechnique 007 for command and scripting interpreter usage via browser-based execution. The exploitation path involves the attacker injecting executable code through an application feature that is intended only for display purposes, leveraging the trust relationship between the web server and the client browsers of site visitors or administrators.
Mitigation strategies must focus on both immediate remediation and long-term defensive coding practices. Administrators running versions of HappyAddons before 3.50.0 should update to the latest patched version immediately to resolve this specific input validation flaw. For environments where updating is not instantly feasible, implementing a Web Application Firewall with rulesets tuned for XSS detection can provide an additional layer of defense by blocking requests containing suspicious script patterns in icon fields. Furthermore, developers and site administrators should enforce strict content filtering policies using plugins that sanitize all user inputs before database storage or output rendering. It is crucial to ensure that any custom code or third-party integrations adhere to OWASP guidelines for input validation and output encoding, specifically utilizing context-aware escaping techniques appropriate for HTML attributes to prevent the interpretation of injected data as executable commands.