Skip to content
Sign in
6.8 Medium

CVE-2026-86788 The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the…

Description

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitrary JavaScript when the content is viewed, including by higher-privileged users who review or publish it.

Affected products and versions

Product Affected versions Fixed in
HT Mega Addons for Elementor 3.2 3.2.0 → < 3.2.6 3.2.6

Other CVEs of HT Mega Addons for Elementor

The 2 CVEs of HT Mega Addons for Elementor →
CVE-2026-4106 The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some… 5.3 Medium
Track this CVE