CVE-2026-86788

HT Mega Addons for Elementor (WordPress plugin) versions 3.2.0 through 3.2.5 are vulnerable to Contributor+ Stored XSS via the section headline tag. The plugin does not restrict the HTML tag name used to render section headlines in several widgets and blocks to a safe allowlist, allowing users wi...