6.4
Medium
CVE-2024-3990 The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
Description
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tooltip & Popover Widget in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| HT Mega – Absolute Addons For Elementor 2.5 | earliest → 2.5.0 | No fix stated |
| HT Mega Addons for Elementor – Elementor Widgets & Template Builder 2.5 | earliest → 2.5.0 | No fix stated |
Other CVEs of HT Mega – Absolute Addons For Elementor
The 24 CVEs of HT Mega – Absolute Addons For Elementor →
CVE-2025-13141
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
6.4
Medium
CVE-2025-8068
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification and loss…
4.3
Medium
CVE-2025-8401
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in…
4.3
Medium
CVE-2025-8151
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up…
4.3
Medium