Mega-Bot

Mega Bot ☣ Scanner & Auto Exploiter What's Mega Bot ? from MegaBot import print """ Tool Scanner Tool Auto Exploiter """ About Mega Bot from MegaBot import print """ +----------------------------------+----------------------------------+ 1 X4PriV8 V1 | 22 XAttacker 2.5 official 2 AUto FixerFor...

HT Mega < 3.0.7 - Sensitive Information Disclosure

The HT Mega plugin for WordPress is vulnerable to Sensitive Information Exposure via AJAX actions. This template dynamically extracts the security nonce before exploitation. id: CVE-2026-4106 info: name: HT Mega 3.0.7 - Sensitive Information Disclosure author: EFETR severity: high description: |...

HT Mega – Absolute Addons for Elementor <= 2.2.0 - Missing Authorization to Privilege Escalation

The HT Mega plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.2.0. This is due to missing validation of the regrole parameter on the htmegaajaxregister function. This makes it possible for unauthenticated attackers to create administrator accounts. id...

CVE-2024-4875

CVE-2024-4875 HT Mega – Absolute Addons For Elementor = 2.5.2 - オプション更新に対する認可の欠落 説明: WordPress用プラグイン HT Mega – Absolute Addons For Elementor は、2.5.2 以前のバージョンにおいて、'ajaxdismiss' 関数における capability check の欠落により、データの不正な変更|データの損失に対して脆弱です。これにより、購読者（Subscriber）レベル以上の権限を持つ認証済み攻撃者が、userscanregister...

CVE-2026-4106

CVE-2026-4106: WordPress HT Mega 未認証PII開示エクスプロイト CVE-2026-4106 のための堅牢なマルチスレッド概念実証 PoC エクスプロイトで、WordPress 用プラグイン HT Mega - Absolute Addons for Elementor （バージョン 3.0.7 未満）を標的としています。 脆弱性の概要 HT Mega プラグインは、ウィジェット用の動的コンテンツを取得するために、いくつかの wpajaxnopriv...

CVE-2026-11895

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'displayoptions' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-89666

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'displayoptions' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-11895

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.1.1 . The root cause is insufficient input sanitization and output escaping within the Data Table 'display_options'...

CVE-2026-11895 HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'displayoptions' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-11895 HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'displayoptions' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it...

WordPress HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by kiemtiendinhau in WordPress Plugin HT Mega versions = 3.1.1...

CVE-2026-14855

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVE-2026-15650

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointermenuitem' Block Attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-14855

The RT Mega Menu WordPress plugin (all versions up to and including 1.5.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) through the css[left] parameter, processed via the rtmega_update_menu_options AJAX action. The root cause is insufficient input sanitization and output escaping . Authent...

EUVD-2026-82644

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVE-2026-14855 RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVE-2026-14855 RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVE-2026-15650 RT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointermenuitem' Block Attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15650 RT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointermenuitem' Block Attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15650

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg WordPress plugin (versions ≤ 1.5.2) is vulnerable to an authenticated stored cross-site scripting (XSS) via the pointer_menu_item block attribute. The root cause is insufficient input sanitization and output escaping : the payload byp...