What’s Vulnerable › Products

devitemsllc HT Mega Addons for Elementor – Elementor Widgets & Template Builder vulnerabilities

33 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your devitemsllc HT Mega Addons for Elementor – Elementor Widgets & Template Builder version is affected

Latest devitemsllc HT Mega Addons for Elementor – Elementor Widgets & Template Builder vulnerabilities

• CVE-2026-111318 — HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink (CVSS 5.4)
• CVE-2026-11895 — HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting (CVSS 6.4)
• CVE-2025-13141 — HT Mega – Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection (CVSS 6.4)
• CVE-2025-54695 — WordPress HT Mega Plugin plugin <= 2.9.0 - Broken Access Control Vulnerability (CVSS 5.4)
• CVE-2025-8401 — HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure (CVSS 4.3)
• CVE-2025-8151 — HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions (CVSS 4.3)
• CVE-2025-8068 — HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions (CVSS 4.3)
• CVE-2025-1802 — HT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 5.4)
• CVE-2025-1261 — HT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget (CVSS 5.4)
• CVE-2024-12599 — HT Mega – Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4)
• CVE-2024-12597 — HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css (CVSS 5.4)
• CVE-2024-8910 — HT Mega – Absolute Addons For Elementor <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_id (CVSS 4.3)
• CVE-2024-38706 — WordPress HT Mega plugin <= 2.5.7 - JSON Path Traversal vulnerability (CVSS 8.8)
• CVE-2024-5215 — HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 5.4)
• CVE-2024-5173 — HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings (CVSS 5.4)
• CVE-2024-4876 — HT Mega – Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2024-4875 — HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update (CVSS 4.3)
• CVE-2023-37999 — WordPress HT Mega Absolute Addons for Elementor plugin <= 2.2.0 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8)
• CVE-2024-3990 — HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget (CVSS 5.4)
• CVE-2024-3989 — HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify (CVSS 5.4)
• CVE-2024-3308 — HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid Widget (CVSS 5.4)
• CVE-2024-3307 — HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 5.4)
• CVE-2024-2790 — HT Mega – Absolute Addons For Elementor <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion/FAQ (CVSS 5.4)
• CVE-2024-2085 — HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' (CVSS 5.4)
• CVE-2024-2084 — HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widget (CVSS 5.4)