ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-85006

Happy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button Widget

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-85006

Published

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser of anyone who views the page, including higher-privileged users reviewing the content, even though such users do not hold the unfiltered_html capability.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-85006

Published

HappyAddons for Elementor

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "HappyAddons for Elementor",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "0",
                            "lessThan": "3.50.0"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON