CVE-2026-85006 is a stored Cross-Site Scripting vulnerability in the HappyAddons for Elementor WordPress plugin versions prior to 3.50.0. The plugin fails to properly escape an icon value in one of its button widgets before outputting it inside an HTML attribute. This allows users with Contributor-level access and above to inject event-handler attributes that execute arbitrary JavaScript in the browser context of anyone viewing the page, including higher-privileged users without unfiltered_html capability.

An attacker with Contributor-level access can inject malicious JavaScript that executes in the browsers of other users viewing the affected content. This can lead to session hijacking, privilege escalation, or other malicious actions executed in the context of the victim's browser. The vulnerability affects users with higher privileges who do not have the unfiltered_html capability, increasing the risk of compromise within the WordPress environment.

Upgrade the HappyAddons for Elementor plugin to version 3.50.0 or later, where this vulnerability is fixed. No other mitigation is indicated as the fix is available in the updated version.