WordPress plugin
HT Mega Addons for Elementor – Elementor Widgets & Template Builder security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 36 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High2
- Medium33
- Low0
All HT Mega Addons for Elementor – Elementor Widgets & Template Builder vulnerabilities
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink
≤3.2.7Update to 3.2.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting
≤3.1.1Update to 3.1.2
- Medium6.43.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
3.2.0 – 3.2.5Update to 3.2.6
- Medium5.3Unauthenticated Information Exposure
<3.0.7Update to 3.0.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection
≤3.0.0Update to 3.0.1
- Medium4.3Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions
≤2.9.1Update to 2.9.2
- Medium4.3Missing Authorization
≤2.9.0Update to 2.9.1
- Medium4.3Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions
≤2.9.1Update to 2.9.2
- Medium4.3Authenticated (Author+) Sensitive Information Exposure
≤2.9.1Update to 2.9.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
≤2.8.3Update to 2.8.4
- Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget
≤2.8.2Update to 2.8.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
≤2.8.1Update to 2.8.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css
≤2.7.6Update to 2.7.7
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure via template_id
≤2.6.5Update to 2.6.6
- Medium4.3Authenticated (Contributor+) JSON File Directory Traversal
≤2.5.7Update to 2.5.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
≤2.5.5Update to 2.5.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings
≤2.5.5Update to 2.5.6
- High8.8Authenticated (Contributor+) Directory Traversal
≤2.4.6Update to 2.4.7
- Medium4.3Missing Authorization to Options Update
≤2.5.2Update to 2.5.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.5.2Update to 2.5.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify
≤2.5.0Update to 2.5.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget
≤2.5.0Update to 2.5.1
- Medium4.3Missing Authorization to Information Exposure
≤2.4.7Update to 2.4.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid Widget
≤2.4.9Update to 2.5.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'size'
≤2.4.6Update to 2.4.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widget
≤2.4.6Update to 2.4.7
- High7.5Sensitive Information Exposure via purchased_products
≤2.4.6Update to 2.4.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion/FAQ
≤2.4.8Update to 2.4.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
≤2.4.9Update to 2.5.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.4.3Update to 2.4.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via titleTag
≤2.4.6Update to 2.4.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Carousel Widget
≤2.4.4Update to 2.4.5
- Medium4.3Cross-Site Request Forgery via Several Functions
≤2.3.3Update to 2.3.4
- Medium6.1Reflected Cross-Site Scripting
≤2.3.8Update to 2.3.9
- Critical9.8Missing Authorization to Privilege Escalation
<2.2.1Update to 2.2.1
- Medium5.4Absolute Addons for Elementor Page Builder <= 1.5.5 - Contributor+ Stored Cross-Site Scripting
≤1.5.5Update to 1.5.7
HT Mega Addons for Elementor – Elementor Widgets & Template Builder: common questions
Does HT Mega Addons for Elementor – Elementor Widgets & Template Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 36 known vulnerabilities in HT Mega Addons for Elementor – Elementor Widgets & Template Builder: 1 critical, 2 high, 33 medium. None are known to affect version null.
How do I check which version of HT Mega Addons for Elementor – Elementor Widgets & Template Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent HT Mega Addons for Elementor – Elementor Widgets & Template Builder vulnerability?
CVE-2026-111318, published Oct 28, 2026: HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink. Severity: Medium (CVSS 5.4).
Is any HT Mega Addons for Elementor – Elementor Widgets & Template Builder vulnerability listed in CISA KEV?
No. None of the known HT Mega Addons for Elementor – Elementor Widgets & Template Builder vulnerabilities is currently listed in the CISA KEV catalog.