CVE-2026-85016 is a stored Cross-Site Scripting vulnerability in the Unlimited Elements for Elementor WordPress plugin prior to version 2.0.21. The vulnerability arises because the plugin fails to escape an icon value before concatenating it into an HTML attribute within its shared widget-parameter processor. This improper sanitization allows users with Contributor-level permissions, who lack unfiltered_html rights, to inject a payload that executes in the context of the page when rendered.

An attacker with Contributor access can inject malicious scripts that execute in the context of users viewing the affected page. This could lead to session hijacking, defacement, or other client-side attacks depending on the payload. However, exploitation requires authenticated Contributor-level access, limiting the attack surface.

Upgrade the Unlimited Elements for Elementor plugin to version 2.0.21 or later, where this vulnerability is fixed. No other mitigation actions are indicated by the vendor advisory. Patch status is confirmed by the version boundary provided.