Ultimate Addons for Elementor < 2.9.2 - Contributor+ Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the Navigation Menu widget's `data-toggle-icon` and `data-close-icon` attributes due to insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. `wp_kses_post`, applied on save for users without `unfiltered_html`, does not neutralize HTML-entity-encoded payloads stored inside `data-*` attributes on kses-allowed elements, as the browser decodes these values client-side before jQuery `.html()` renders them as markup.