The βHT Mega β Absolute Addons for Elementor Page Builderβ WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
5.4CVSS
5.2AI Score
0.001EPSS
Improper Privilege Management vulnerability in HasThemes HT Mega allows Privilege Escalation.This issue affects HT Mega: from n/a through 2.2.0.
9.8CVSS
6.9AI Score
0.0004EPSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes HT Mega β Absolute Addons For Elementor allows Reflected XSS.This issue affects HT Mega β Absolute Addons For Elementor: from n/a through 2.3.8.
7.1CVSS
6.5AI Score
0.0005EPSS
Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Mega β Absolute Addons For Elementor.This issue affects HT Mega β Absolute Addons For Elementor: from n/a through 2.3.3.
4.3CVSS
4.6AI Score
0.0004EPSS
The HT Mega β Absolute Addons For Elementor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.6 via the render function. This makes it possible for authenticated attackers, with contributor access or higher, to read the contents of arbitrary files o...
8.8CVSS
9AI Score
0.0004EPSS