Description

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser of anyone who views the page, including higher-privileged users reviewing the content, even though such users do not hold the unfiltered_html capability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-23T06:17:03.703Z",
  "pubdate": "2026-09-23T06:17:03.703Z",
  "executiveSummary": "HappyAddons for Elementor versions prior to 3.50.0 are susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. The flaw originates from the improper sanitization and output escaping of icon attributes within a specific button widget.\nThis vulnerability allows authenticated users with Contributor-level access or higher to inject malicious JavaScript into the plugin's widget configuration. When rendered, this payload executes in the browser of any user viewing the page, including administrators.\nThe risk is significant because it facilitates privilege escalation, session hijacking, or unauthorized administrative actions by leveraging the elevated permissions of a victim who views the injected content. Exploitation does not require the attacker to possess the 'unfiltered_html' capability, bypassing standard WordPress security restrictions for lower-privileged users.",
  "technicalDetails": "The vulnerability exists due to a lack of proper input sanitization and output escaping on the icon attribute property within the HappyAddons button widget component. In the vulnerable versions, the plugin fails to sanitize or escape user-supplied data before inserting it into an HTML attribute, effectively breaking out of the intended attribute context.\nThe attack flow begins when an authenticated user (Contributor or higher) modifies the widget settings via the Elementor editor. The attacker injects a malicious payload, such as an event handler attribute (e.g., 'onmouseover=alert(1)' or similar JavaScript execution vectors) into the icon field. Because the plugin does not properly validate or sanitize this input, the malicious payload is stored directly within the WordPress database as part of the widget's settings.\nWhen a victim, such as an administrator or another user, loads a page containing the compromised button widget, the plugin renders the malicious icon attribute as part of the HTML output. The browser interprets the injected event handler attribute, executing the attacker-supplied JavaScript within the victim's session context.\nThe scope of the impact is severe because the script runs under the victim's session, granting the attacker the ability to perform actions on behalf of the victim. This includes modifying system configurations, creating new administrator accounts, or exfiltrating sensitive session tokens. Furthermore, the attack bypasses the 'unfiltered_html' security constraint, as the execution is triggered via an existing, authorized widget component rather than direct raw HTML input.\nThe vulnerability affects all versions of HappyAddons for Elementor up to, but not including, 3.50.0. The lack of output encoding within the widget rendering logic remains the core technical root cause, necessitating a comprehensive update to the plugin’s rendering methods to ensure that all user-controllable attributes are subjected to strict whitelist-based sanitization and appropriate HTML attribute escaping."
}