WordPress HappyAddons for Elementor authorization issue vulnerability

WordPress HappyAddons for Elementor versions 3.50.1 and earlier contain an authorization issue vulnerability. This vulnerability stems from missing authorization checks, which may lead to exploitation of improperly configured access control security levels...

Cross-site scripting vulnerability in WordPress HappyAddons for Elementor

WordPress HappyAddons for Elementor versions 3.50.1 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input handling during web page generation and may lead to stored cross-site scripting attacks...

CVE-2026-85006

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser o...

EUVD-2026-85041

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser o...

WordPress HappyAddons for Elementor plugin < 3.50.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Happy Addons for Elementor versions 3.50.0...

PT-2026-97177

Name of the Vulnerable Software and Affected Versions HappyAddons for Elementor versions prior to 3.50.0 Description An issue exists where an icon value in a button widget is not properly escaped before being output within an HTML attribute. This allows users with Contributor-level access or high...

CVE-2026-85006: Improper Neutralization of Input During Web Page Generation

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser o...