Ultimate Addons navigation icons allow contributor stored XSS

Update, patch or deactivate.

Update Ultimate Addons for Elementor to 2.9.2 or later. If an immediate update is impossible, backport the vendor's self-contained hfe_sanitize_icon_html() helper from WordPress Trac changeset 3614409 into inc/js/frontend.js, then pass both toggle_icon and close_icon through that helper before their jQuery .html() calls. Review Navigation Menu widgets edited by untrusted contributors and remove unexpected encoded markup from their toggle and close icon attributes.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.