HT Mega – Absolute Addons for Elementor <= 2.2.0 - Missing Authorization to Privilege Escalation

The HT Mega plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.2.0. This is due to missing validation of the regrole parameter on the htmegaajaxregister function. This makes it possible for unauthenticated attackers to create administrator accounts. id...

HT Mega < 3.0.7 - Sensitive Information Disclosure

The HT Mega plugin for WordPress is vulnerable to Sensitive Information Exposure via AJAX actions. This template dynamically extracts the security nonce before exploitation. id: CVE-2026-4106 info: name: HT Mega 3.0.7 - Sensitive Information Disclosure author: EFETR severity: high description: |...

CVE-2026-4106

CVE-2026-4106: WordPress HT Mega Unauthenticated PII Disclosure Exploit A robust, multi-threaded Proof of Concept PoC exploit for CVE-2026-4106 , targeting the HT Mega - Absolute Addons for Elementor plugin for WordPress versions 3.0.7. Vulnerability Overview The HT Mega plugin registers several...

CVE-2024-4875

CVE-2024-4875 HT Mega – Absolute Addons For Elementor = 2.5.2 - Missing Authorization to Options Update Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a missing capability check on the...

VulnCheck KEV: CVE-2026-4106

The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some PII such as full name, city, state and country of customers who placed orders in the last 7 days...

VulnCheck KEV: CVE-2023-6214

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.6 via the purchasedproducts function. This makes it possible for unauthenticatied attackers to extract sensitive data including the previous 7...

CVE-2026-11895

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'displayoptions' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-89666

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'displayoptions' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-11895 HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'displayoptions' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-11895

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.1.1 . The root cause is insufficient input sanitization and output escaping within the Data Table 'display_options'...

CVE-2026-11895 HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'displayoptions' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-103052

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'display options' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-11895: Improper Neutralization of Input During Web Page Generation

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'displayoptions' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it...

WordPress HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by kiemtiendinhau in WordPress Plugin HT Mega versions = 3.1.1...

CVE-2026-86788

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...

EUVD-2026-81342

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...

CVE-2026-86788

The HT Mega Addons for Elementor WordPress plugin, in versions 3.2.0 through 3.2.5 , contains a Stored Cross-Site Scripting (XSS) vulnerability. The issue stems from a failure to restrict HTML tag names used to render section headlines in several widgets and blocks to a safe allowlist. This allow...

CVE-2026-86788 HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...

WordPress HT Mega Addons for Elementor plugin 3.2.0-3.2.5 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin HT Mega versions 3.2.0-3.2.5...

CVE-2026-86788 HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...