CVE-2026-85006

Name of the Vulnerable Software and Affected Versions HappyAddons for Elementor versions prior to 3.50.0

Description An issue exists where an icon value in a button widget is not properly escaped before being output within an HTML attribute. This allows users with Contributor-level access or higher to inject event-handler attributes that execute JavaScript in the browser of any user viewing the page, including those with higher privileges, regardless of whether they possess the unfiltered html capability.

Recommendations Update HappyAddons for Elementor to version 3.50.0 or later.