CVE-2026-85006: HappyAddons for Elementor XSS Vulnerability

CVE-2026-85006 Overview

CVE-2026-85006 is a stored Cross-Site Scripting (XSS) vulnerability in the HappyAddons for Elementor WordPress plugin before version 3.50.0. The plugin fails to escape an icon value on one of its button widgets before rendering it inside an HTML attribute. Contributors and higher-privileged users can inject event-handler attributes that execute arbitrary JavaScript when any visitor renders the page. The flaw allows Contributor-level users to bypass the unfiltered_html capability restriction and target higher-privileged reviewers such as editors and administrators.

Critical Impact
Authenticated attackers with Contributor access can execute JavaScript in the browsers of administrators reviewing content, enabling account takeover and further compromise of the WordPress site.

Affected Products

HappyAddons for Elementor WordPress plugin versions prior to 3.50.0
WordPress sites allowing Contributor-level registration or higher
Elementor-based sites relying on HappyAddons button widgets

Discovery Timeline

2026-09-23 - CVE-2026-85006 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-85006

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified as [CWE-79] Improper Neutralization of Input During Web Page Generation. HappyAddons for Elementor exposes a button widget that accepts an icon value from the page editor. The plugin outputs that value inside an HTML attribute without proper escaping. An attacker with Contributor privileges supplies a crafted icon string that closes the intended attribute and appends an event-handler attribute such as onmouseover or onerror. When any user renders the page, including editors or administrators reviewing pending submissions, the injected JavaScript executes in their browser session.

WordPress normally restricts JavaScript injection through the unfiltered_html capability, which is denied to Contributors. This vulnerability bypasses that control because the plugin, not WordPress core, handles the icon field. See the WPScan Vulnerability Report for additional technical detail.

Root Cause

The root cause is missing output escaping. The button widget concatenates the user-controlled icon value into an HTML attribute context without calling esc_attr() or an equivalent sanitization function. Any character permitted in the icon field, including quotes and whitespace, reaches the rendered DOM unchanged.

Attack Vector

Exploitation requires an authenticated Contributor account and one user interaction to trigger the payload. The attacker creates or edits a post using a HappyAddons button widget and supplies a malicious icon value. When an editor or administrator previews or reviews the post, the script executes with that user's session cookies and privileges. Successful exploitation can add administrator accounts, modify plugin settings, or plant persistent backdoors.

No verified public exploit code is available. See the WPScan advisory for detailed technical references.

Detection Methods for CVE-2026-85006

Indicators of Compromise

Post or page revisions authored by Contributor accounts containing HTML event-handler attributes (onerror, onmouseover, onclick) within HappyAddons widget markup
Unexpected administrator account creation or role changes shortly after content review sessions
Outbound HTTP requests from administrator browsers to unfamiliar domains while editing WordPress content

Detection Strategies

Scan the wp_posts table for HappyAddons button widget shortcodes or JSON payloads containing quote characters followed by on*= handler patterns in icon fields
Review WordPress audit logs for Contributor-authored posts that were later viewed by administrators
Deploy a web application firewall rule that inspects Elementor widget data for HTML attribute-breaking sequences in icon parameters

Monitoring Recommendations

Enable a WordPress activity log plugin to record post edits, role changes, and plugin configuration changes
Monitor administrator sessions for anomalous XHR or fetch requests originating from the WordPress admin interface
Alert on installation of new plugins or themes immediately following content review actions

How to Mitigate CVE-2026-85006

Immediate Actions Required

Update HappyAddons for Elementor to version 3.50.0 or later on all WordPress installations
Audit existing posts and pages created by Contributor or Author accounts for injected event-handler attributes in HappyAddons widgets
Reset passwords and rotate session tokens for administrator accounts that may have reviewed malicious content

Patch Information

The vendor addressed the issue in HappyAddons for Elementor version 3.50.0 by escaping the icon value before it is placed into the HTML attribute context. Site operators should apply the update through the WordPress plugin manager or WP-CLI using wp plugin update happy-elementor-addons.

Workarounds

Restrict Contributor and Author roles to trusted users until the patch is applied
Disable the HappyAddons for Elementor plugin on sites that cannot immediately update
Configure a web application firewall to block HTML attribute injection patterns in Elementor widget submissions

bash

# Configuration example
wp plugin update happy-elementor-addons --version=3.50.0
wp user list --role=contributor --fields=ID,user_login,user_email