CVE-2026-86788

HT Mega Addons for Elementor (WordPress plugin) versions 3.2.0 through 3.2.5 are vulnerable to Contributor+ Stored XSS via the section headline tag. The plugin does not restrict the HTML tag name used to render section headlines in several widgets and blocks to a safe allowlist, allowing users wi...

CVE-2026-86788 HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...