CVE-2023-51529

CVE-2023-51529 is a Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Mega – Absolute Addons For Elementor, affecting HT Mega – Absolute Addons For Elementor versions up to 2.3.3. The issue enables unauthorized actions to be performed on behalf of an authenticated user, as indicated...

CVE-2024-1974

CVE-2024-1974 : The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Directory Traversal in render() in versions up to 2.4.6. Authenticated attackers with contributor+ access can read arbitrary server files. The issue is documented by Wordfence and Red Hat; a fix is a...

CVE-2023-37999

HT Mega (Absolute Addons for Elementor) for WordPress

CVE-2024-3308

CVE-2024-3308 affects HT Mega – Absolute Addons For Elementor (WordPress). Stored XSS in the Image Grid widget before/including v2.4.9 due to insufficient input sanitization and output escaping; exploitable by authenticated users with Contributor+ access. Root cause: inadequate sanitization/escap...

CVE-2021-24261

CVE-2021-24261 affects WordPress HT Mega – Absolute Addons for Elementor Page Builder prior to 1.5.7 . Public sources describe stored XSS in multiple widgets (for example, htmega_call_to_action, htmega_section_title, htmega_accordion, and related fields) that can be exploited by lower-privileged ...

CVE-2024-1397

CVE-2024-1397 concerns the HT Mega – Absolute Addons For Elementor WordPress plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) in the plugin blocks via the titleTag attributes supplied by users, caused by insufficient input sanitization and output escaping. Affected versions are up...

CVE-2024-2790

CVE-2024-2790 affects HT Mega – Absolute Addons For Elementor (WordPress) up to version 2.4.8, due to insufficient input sanitization and output escaping on Accordion widget attributes. This enables stored XSS by authenticated users with contributor+ privileges, affecting pages accessed by other ...

CVE-2024-3307

The HT Mega – Absolute Addons For Elementor WordPress plugin is vulnerable to DOM-Based Stored Cross-Site Scripting via the Countdown widget. Concrete details across connected documents: all versions up to and including 2.8.2 are affected due to insufficient input sanitization and output escaping...

CVE-2025-1802

CVE-2025-1802 (HT Mega – Absolute Addons For Elementor, WordPress) : Stored Cross-Site Scripting via the marker_title, notification_content, and stt_button_text parameters affects all versions up to and including 2.8.3. Root cause is insufficient input sanitization and output escaping. This enabl...

CVE-2024-2084

CVE-2024-2084 affects HT Mega – Absolute Addons For Elementor (WordPress) via the lightbox widget. Connected sources confirm a Stored XSS due to insufficient input sanitization and output escaping for user-supplied attributes in versions up to and including 2.4.6. Impact requires authentication a...

CVE-2024-32782

CVE-2024-32782 concerns an Information Exposure vulnerability in the HasThemes HT Mega plugin for WordPress, with HT Mega versions listed as affected up to 2.4.7. The Red Hat entry mirrors this description, stating an Exposure of Sensitive Information to an Unauthorized Actor vulnerability affect...

CVE-2024-4876

CVE-2024-4876 refers to HT Mega – Absolute Addons For Elementor (WordPress). Connected Red Hat/Wordfence data confirm a Stored Cross-Site Scripting vulnerability due to insufficient input sanitization and output escaping in the popover_header_text parameter, affecting HT Mega versions up to 2.5.2...

CVE-2024-2085

The CVE-2024-2085 issue affects HT Mega – Absolute Addons For Elementor (WordPress). It is a Stored XSS due to insufficient input sanitization and output escaping on the size attribute in multiple widgets. Affected versions are up to 2.4.6. Exploitation requires an authenticated user with contrib...

CVE-2024-1421

CVE-2024-1421: HT Mega – Absolute Addons For Elementor stores XSS via the Post Carousel border_type in all versions

CVE-2024-4875

CVE-2024-4875 affects the HT Mega – Absolute Addons For Elementor WordPress plugin. A missing capability check in ajax_dismiss in versions up to 2.5.2 allows authenticated users with subscriber-level permissions and above to modify options such as users_can_register, enabling unauthorized user re...

CVE-2024-5215

CVE-2024-5215 affects the HT Mega – Absolute Addons For Elementor WordPress plugin. The vulnerability is Stored Cross‑Site Scripting caused by insufficient input sanitization and output escaping on user-supplied attributes in multiple widgets. Affected versions are all up to and including 2.5.5. ...

CVE-2024-5173

The HT Mega – Absolute Addons For Elementor WordPress plugin (versions ≤ 2.5.5) is vulnerable to stored XSS via the Video Player widget settings due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at Contributor level or higher, enabling injectio...

CVE-2024-12599

CVE-2024-12599 affects HT Mega – Absolute Addons For Elementor (WordPress). It is a Stored XSS via the Countdown widget in all versions up to 2.8.1, caused by insufficient input sanitization and output escaping for user-supplied attributes. Exploitation requires authenticated access at contributo...

CVE-2024-12597

CVE-2024-12597 (HT Mega – Absolute Addons For Elementor for WordPress) is a stored XSS vulnerability in the block_css and inner_css parameters, present in all versions up to 2.7.6. The issue requires authenticated access at Contributor level or higher and can cause arbitrary scripts to execute wh...

CVE-2023-6214

CVE-2023-6214 (HT Mega – Absolute Addons For Elementor) affects the WordPress plugin HT Mega up to version 2.4.6. The root issue is a data exposure in the purchased_products function, allowing unauthenticated access to the previous 7 days of order data and customer PII. The vulnerability is categ...

CVE-2024-30182

CVE-2024-30182 describes a Stored XSS in HasThemes HT Mega for Elementor caused by improper neutralization of input during web page generation. Affected: HT Mega up to version 2.4.3. Public details in the provided documents specify the issue and affected range but do not include a confirmed patch...

CVE-2025-1261

CVE-2025-1261 affects HT Mega – Absolute Addons For Elementor (WordPress) up to version 2.8.2. It is a DOM-Based Stored Cross-Site Scripting vulnerability in the Countdown widget caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authe...

CVE-2024-38706

Technical details about CVE-2024-38706 are not publicly provided in the connected documents. Please monitor for updates from vendors/affiliates for affected HT Mega versions and remediation status.

CVE-2023-50901

CVE-2023-50901 describes a reflected XSS in HasThemes HT Mega – Absolute Addons For Elementor, affecting HT Mega for Elementor versions up to 2.3.8. The root cause is improper neutralization of user input during web page generation. Impact is cross-site scripting on pages that incorporate the vul...

CVE-2024-8910

CVE-2024-8910 concerns HT Mega – Absolute Addons For Elementor for WordPress. The vulnerability affects versions up to and including 2.6.5 and enables Sensitive Information Exposure via the render function in includes/widgets/htmega_accordion.php. Exploitation requires at least Contributor-level ...

CVE-2025-8401

The CVE concerns the WordPress plugin HT Mega – Absolute Addons For Elementor (WordPress) with vulnerable behavior in get_post_data. All versions up to and including 2.9.1 allow authenticated attackers with Author-level access or higher to disclose sensitive information, including the content of ...

CVE-2024-3989

The CVE CVE-2024-3989 affects the HT Mega – Absolute Addons For Elementor WordPress plugin. The issue is a Stored Cross-Site Scripting vulnerability in the Gallery Justify widget, arising from insufficient input sanitization and output escaping for user-supplied attributes. It is exploitable by a...

CVE-2024-3990

CVE-2024-3990 applies to HT Mega – Absolute Addons For Elementor for WordPress. It is a Stored Cross-Site Scripting vulnerability in the Tooltip & Popover Widget present in all versions up to and including 2.5.0, caused by insufficient input sanitization and output escaping on user-supplied attri...

CVE-2025-8068

The CVE-2025-8068 issue affects the WordPress plugin HT Mega – Absolute Addons For Elementor. A vulnerability in the ajax_trash_templates function arises from an improper capability check, making authenticated users with Contributor-level access and above able to delete arbitrary attachment files...

CVE-2025-8151

CVE-2025-8151 (HT Mega – Absolute Addons For Elementor) is a path traversal vulnerability in the WordPress plugin HT Mega up to version 2.9.1. The flaw resides in the save_block_css function and can be exploited by an authenticated user with Author+ privileges to create and delete CSS files in an...