HappyAddons for Elementor CVE-2026-85006

Requires an authenticated WordPress account with at least Contributor role on a site running HappyAddons for Elementor before 3.50.0, plus use of the affected button widget so the attacker-controlled icon value is rendered into an HTML attribute. Exploitation is limited by (1) needing a valid low-privilege account (not fully unauthenticated), (2) UI:R - a higher-privileged user must actually view/preview the injected content for the payload to fire, and (3) the payload only matters because these Contributor accounts normally lack the unfiltered_html capability, so the bug is what enables the script injection in the first place. Not exploitable against default configs without a Contributor+ foothold.

This is a stored/authenticated Cross-Site Scripting (CWE-79) issue in the HappyAddons for Elementor WordPress plugin, a moderate-severity privilege-escalation vector rather than a mass-exploitable remote flaw. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, 6.8) is internally inconsistent with the description: it uses PR:H, yet the description explicitly states the flaw is reachable at 'Contributor-level access and above' - a LOW-privilege WordPress role - so PR:L is the honest choice and PR:H appears to be a WPScan scoring convention rather than a true high-privilege requirement. The C:H/I:H/A:H impact set is also aggressive for a browser-context XSS and likely reflects the worst-case (admin session hijack → site takeover) rather than the direct scripting impact, which is more typically C:L/I:L with S:C. No EPSS score, no CISA KEV listing, and no confirmed public POC were provided, so there is no evidence of active or automated exploitation; the real value of the bug is that it lets a low-trust contributor bypass the missing unfiltered_html capability and land script in the browser of an admin reviewing their content. Net: a legitimate patch-worthy insider/privilege-escalation issue, not an emergency internet-wide threat. Key conflict to verify with the vendor/WPScan: PR:H vs. the description's Contributor-level requirement.

A user with only Contributor-level access on a target WordPress site adds a HappyAddons button widget and sets a malicious icon value containing an event-handler attribute (e.g. onmouseover/onerror) that is written unescaped into the page's HTML. When an editor or administrator reviews the pending post, the payload executes in their authenticated browser session, enabling session/cookie theft or admin actions performed as the victim. No public exploit code was identified in the provided data, though the technique is a well-known contributor-to-admin XSS pattern.