CVE-2026-111318

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...

EUVD-2026-112693

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...

WordPress HT Mega Addons for Elementor cross-site scripting vulnerability

WordPress HT Mega Addons for Elementor versions 3.2.7 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and output escaping. Attackers can exploit this by injecting arbitrary web scripts via the href attribute of elements within...

PT-2026-130682

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...

CVE-2026-111318: devitemsllc HT Mega Addons for Elementor – Elementor Widgets & Template Builder: The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored…

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...

Exploit for CVE-2026-4106

WordPress HTMega Unauthenti...

WordPress HT Mega Plugin <= 2.4.7 is vulnerable to Sensitive Data Exposure

Software HT Mega Type Plugin Vulnerable versions = 2.4.7 Fixed in 2.4.8 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-32782 Patch priority Low CVSS severity Low 4.3 Developer HTMega PSID ae2be9eaec1a Credits Khalid Yusuf Required privilege Contributor...

WordPress HT Mega Plugin <= 2.4.6 is vulnerable to Directory Traversal

Software HT Mega Type Plugin Vulnerable versions = 2.4.6 Fixed in 2.4.7 OWASP Top 10 A5: Broken Access Control Classification Directory Traversal CVE CVE-2024-1974 Patch priority Low CVSS severity Low 7.7 Developer HTMega PSID 6d7e2f2731f2 Credits Webbernaut Required privilege Contributor Publish...