EN ES
Start free
Menu

HT Mega Addons for Elementor: known security problems

36 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 36 known security problems on this page. Each one has a fixed version. Updating to version 3.2.8 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

A stranger could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.7
Fixed in
3.2.8
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 3.2.8 or newer.
Official ID
CVE-2026-111318
Report title
HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.1.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.1.1
Fixed in
3.1.2
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 3.1.2 or newer.
Official ID
CVE-2026-11895
Report title
HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 3.2.0 up to and including 3.2.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 3.2.0 up to and including 3.2.5
Fixed in
3.2.6
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 3.2.6 or newer.
Official ID
CVE-2026-86788
Report title
HT Mega 3.2.0 - 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.0.7
Fixed in
3.0.7
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 3.0.7 or newer.
Official ID
CVE-2026-4106
Report title
HT Mega Addons for Elementor – Elementor Widgets & Template Builder < 3.0.7 - Unauthenticated Information Exposure
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.0.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.0.0
Fixed in
3.0.1
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 3.0.1 or newer.
Official ID
CVE-2025-13141
Report title
HT Mega – Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection
First reported
Sources
This week

Someone with an author account on your site could read or delete private files on your server

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.1
Fixed in
2.9.2
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.9.2 or newer.
Official ID
CVE-2025-8151
Report title
HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions
First reported
Sources
This week

Someone with an author account on your site could see private information they should not see

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.1
Fixed in
2.9.2
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.9.2 or newer.
Official ID
CVE-2025-8401
Report title
HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 2.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.1
Fixed in
2.9.2
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.9.2 or newer.
Official ID
CVE-2025-8068
Report title
HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 2.9.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.0
Fixed in
2.9.1
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.9.1 or newer.
Official ID
CVE-2025-54695
Report title
HT Mega <= 2.9.0 - Missing Authorization
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.8.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.3
Fixed in
2.8.4
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.8.4 or newer.
Official ID
CVE-2025-1802
Report title
HT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.8.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.2
Fixed in
2.8.3
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.8.3 or newer.
Official ID
CVE-2025-1261
Report title
HT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.8.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.1
Fixed in
2.8.2
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.8.2 or newer.
Official ID
CVE-2024-12599
Report title
HT Mega – Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.7.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.6
Fixed in
2.7.7
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.7.7 or newer.
Official ID
CVE-2024-12597
Report title
HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css
First reported
Sources
This week

Someone with a contributor account on your site could see private information they should not see

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.6.5
Fixed in
2.6.6
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.6.6 or newer.
Official ID
CVE-2024-8910
Report title
HT Mega – Absolute Addons For Elementor <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_id
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 2.5.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.5.7
Fixed in
2.5.8
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.5.8 or newer.
Official ID
CVE-2024-38706
Report title
HT Mega <= 2.5.7 - Authenticated (Contributor+) JSON File Directory Traversal
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.5.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.5.5
Fixed in
2.5.6
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.5.6 or newer.
Official ID
CVE-2024-5215
Report title
HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.5.5) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.5.5
Fixed in
2.5.6
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.5.6 or newer.
Official ID
CVE-2024-5173
Report title
HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 2.4.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.4.6
Fixed in
2.4.7
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.4.7 or newer.
Official ID
CVE-2024-1974
Report title
HT Mega – Absolute Addons For Elementor <= 2.4.5 - Authenticated (Contributor+) Directory Traversal
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 2.5.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.5.2
Fixed in
2.5.3
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.5.3 or newer.
Official ID
CVE-2024-4875
Report title
HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.5.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.5.2
Fixed in
2.5.3
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.5.3 or newer.
Official ID
CVE-2024-4876
Report title
HT Mega – Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.5.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.5.0
Fixed in
2.5.1
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.5.1 or newer.
Official ID
CVE-2024-3989
Report title
HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.5.0) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.5.0
Fixed in
2.5.1
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.5.1 or newer.
Official ID
CVE-2024-3990
Report title
HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 2.4.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.4.7
Fixed in
2.4.8
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.4.8 or newer.
Official ID
CVE-2024-32782
Report title
HT Mega – Absolute Addons For Elementor <= 2.4.7 - Missing Authorization to Information Exposure
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.4.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.4.6
Fixed in
2.4.7
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.4.7 or newer.
Official ID
CVE-2024-2085
Report title
HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size'
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.4.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.4.9
Fixed in
2.5.0
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.5.0 or newer.
Official ID
CVE-2024-3308
Report title
HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.4.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.4.8
Fixed in
2.4.9
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.4.9 or newer.
Official ID
CVE-2024-2790
Report title
HT Mega – Absolute Addons For Elementor <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion/FAQ
First reported
Sources
This week

Someone could see private information they should not see

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.4.6
Fixed in
2.4.7
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.4.7 or newer.
Official ID
CVE-2023-6214
Report title
HT Mega – Absolute Addons For Elementor <= 2.4.6 - Sensitive Information Exposure via purchased_products
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.4.6) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.4.6
Fixed in
2.4.7
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.4.7 or newer.
Official ID
CVE-2024-2084
Report title
HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.4.9) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.4.9
Fixed in
2.5.0
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.5.0 or newer.
Official ID
CVE-2024-3307
Report title
HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.4.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.4.3
Fixed in
2.4.4
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.4.4 or newer.
Official ID
CVE-2024-30182
Report title
HT Mega <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.4.6) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.4.6
Fixed in
2.4.7
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.4.7 or newer.
Official ID
CVE-2024-1397
Report title
HT Mega <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleTag
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.4.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.4.4
Fixed in
2.4.5
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.4.5 or newer.
Official ID
CVE-2024-1421
Report title
HT Mega – Absolute Addons For Elementor <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Carousel Widget
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.3.3
Fixed in
2.3.4
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.3.4 or newer.
Official ID
CVE-2023-51529
Report title
HT Mega <= 2.3.3 - Cross-Site Request Forgery via Several Functions
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.3.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.3.8
Fixed in
2.3.9
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.3.9 or newer.
Official ID
CVE-2023-50901
Report title
HT Mega – Absolute Addons For Elementor <= 2.3.8 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could take over your site as an admin

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.2.1
Fixed in
2.2.1
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 2.2.1 or newer.
Official ID
CVE-2023-37999
Report title
HT Mega – Absolute Addons for Elementor <= 2.2.0 - Missing Authorization to Privilege Escalation
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.5.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.5
Fixed in
1.5.7
What to do
If your site has an affected version, update HT Mega Addons for Elementor to version 1.5.7 or newer.
Official ID
CVE-2021-24261
Report title
HT Mega - Absolute Addons for Elementor Page Builder <= 1.5.5 - Contributor+ Stored Cross-Site Scripting
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)