Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-85006 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser of anyone who views the page, including higher-privileged users reviewing the content, even though such users do not hold the unfiltered_html capability.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:8.7 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

CNA: CISA-ADPCVSS-B:6.8 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://wpscan.com/vulnerability/50319e24-8ae8-40b8-9106-ed881359700e/	[email protected]	AdvisoryExploitRemedy

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	CISA-ADP

Affected Products

Product	Versions
HappyAddons	< 3.50.0 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 3.50.0moderate effort

Change History

2 change records found show changes

Date	Action	Recorded By
Sep 23, 2026	CVE Modified	CISA-ADP
Sep 23, 2026	New CVE Received	[email protected]