CVE-2024-1421 HT Mega – Absolute Addons For Elementor <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Carousel Widget

🗓️ 12 Mar 2024 22:32:26Reported by WordfenceType

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘border_type’ attribute of the Post Carousel widget in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2024-1421	13 Mar 202400:21	–	circl
CNNVD	WordPress Plugin HT Mega Security Vulnerability	12 Mar 202400:00	–	cnnvd
CVE	CVE-2024-1421	12 Mar 202422:32	–	cve
EUVD	EUVD-2024-17175	3 Oct 202520:07	–	euvd
NVD	CVE-2024-1421	12 Mar 202423:15	–	nvd
OSV	CVE-2024-1421	12 Mar 202423:15	–	osv
Patchstack	WordPress HT Mega Plugin <= 2.4.4 is vulnerable to Cross Site Scripting (XSS)	12 Mar 202400:00	–	patchstack
Prion	Cross site scripting	12 Mar 202423:15	–	prion
Positive Technologies	PT-2024-18031 · WordPress · Ht Mega – Absolute Addons For Elementor	12 Mar 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-1421	23 May 202509:58	–	redhatcve

[
  {
    "vendor": "devitemsllc",
    "product": "HT Mega Addons for Elementor – Elementor Widgets & Template Builder",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.4.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.4.4/includes/widgets/htmega_post_carousel.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/a71cbe66-4187-4260-bb87-8579bc6e75f5

08 Apr 2026 17:13Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.4

EPSS0.0032

CWE-79