Skip to content
Sign in
5.4 Medium

CVE-2026-111318 The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored…

Description

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of <a> inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a co-installed plugin such as wpDiscuz with its rich editor enabled whose markup allowlist permits span[class] and a[href] storage, an HT Mega Tabs widget present on the same page as the comment section, and a victim user click on the injected anchor link.

Affected products and versions

Product Affected versions Fixed in
HT Mega Addons for Elementor – Elementor Widgets & Template Builder 3.2 earliest → 3.2.7 No fix stated

Other CVEs of HT Mega Addons for Elementor – Elementor Widgets & Template Builder

The 26 CVEs of HT Mega Addons for Elementor – Elementor Widgets & Template Builder →
CVE-2026-11895 The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored… 6.4 Medium CVE-2025-13141 The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… 6.4 Medium CVE-2025-8068 The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification and loss… 4.3 Medium CVE-2025-8151 The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up… 4.3 Medium
Track this CVE