CVE-2026-86788

HT Mega Addons for Elementor WordPress plugin versions 3.2.0–3.2.5 contain a stored XSS vulnerability in the section headline rendering of several widgets and blocks. The plugin fails to restrict the HTML tag name to a safe allowlist, allowing users with contributor-level access or higher to stor...