Plugin icon

HT Mega Addons for Elementor – Elementor Widgets & Template Builder

ht-mega-for-elementor

Vulnerabilities:

32

Last Updated:

June 24, 2026

Active Installs:

70000

Published
Title
Fixed in
CVSS
Published
2026-04-02
Title
HT Mega < 3.0.7 – Unauthenticated PII Disclosure
Fixed in
Fixed in 3.0.7
CVSS
5.3 (medium)
Published
2025-11-20
Title
HT Mega – Absolute Addons For Elementor < 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection
Fixed in
Fixed in 3.0.1
CVSS
6.4 (medium)
Published
2025-07-30
Title
HT Mega < 2.9.2 - Author+ Sensitive Information Exposure
Fixed in
Fixed in 2.9.2
CVSS
4.3 (medium)
Published
2025-07-30
Title
HT Mega – Absolute Addons For Elementor < 2.9.2 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions
Fixed in
Fixed in 2.9.2
CVSS
4.3 (medium)
Published
2025-07-30
Title
HT Mega < 2.9.1 - Missing Authorization
Fixed in
Fixed in 2.9.1
CVSS
4.3 (medium)
Published
2025-07-30
Title
HT Mega – Absolute Addons For Elementor < 2.9.2 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions
Fixed in
Fixed in 2.9.2
CVSS
4.3 (medium)
Published
2025-03-19
Title
HT Mega – Absolute Addons For Elementor < 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Fixed in
Fixed in 2.8.4
CVSS
6.4 (medium)
Published
2025-03-07
Title
HT Mega – Absolute Addons For Elementor < 2.8.3 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget
Fixed in
Fixed in 2.8.3
CVSS
6.4 (medium)
Published
2025-02-10
Title
HT Mega – Absolute Addons For Elementor < 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
Fixed in
Fixed in 2.8.2
CVSS
7.2 (high)
Published
2025-02-03
Title
HT Mega < 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css
Fixed in
Fixed in 2.7.7
CVSS
6.4 (medium)
Published
2024-09-24
Title
HT Mega – Absolute Addons For Elementor < 2.6.6 - Authenticated (Contributor+) Sensitive Information Exposure via template_id
Fixed in
Fixed in 2.6.6
CVSS
4.3 (medium)
Published
2024-07-11
Title
HT Mega < 2.5.8 - Authenticated (Contributor+) JSON File Directory Traversal
Fixed in
Fixed in 2.5.8
CVSS
4.3 (medium)
Published
2024-06-25
Title
HT Mega – Absolute Addons For Elementor < 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Fixed in
Fixed in 2.5.6
CVSS
6.4 (medium)
Published
2024-06-25
Title
HT Mega – Absolute Addons For Elementor < 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings
Fixed in
Fixed in 2.5.6
CVSS
6.4 (medium)
Published
2024-05-20
Title
HT Mega < 2.5.3 - Subscriber+ Options Update
Fixed in
Fixed in 2.5.3
CVSS
8.8 (high)
Published
2024-05-20
Title
HT Mega < 2.5.3 - Contributor+ Stored XSS
Fixed in
Fixed in 2.5.3
CVSS
5.9 (medium)
Published
2024-05-07
Title
HT Mega – Absolute Addons For Elementor < 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget
Fixed in
Fixed in 2.5.1
CVSS
6.4 (medium)
Published
2024-05-07
Title
HT Mega – Absolute Addons For Elementor < 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify
Fixed in
Fixed in 2.5.1
CVSS
6.4 (medium)
Published
2024-04-22
Title
HT Mega – Absolute Addons For Elementor < 2.4.8 - Missing Authorization to Information Exposure
Fixed in
Fixed in 2.4.8
CVSS
4.3 (medium)
Published
2024-04-16
Title
HT Mega < 2.4.7 - Unauthenticated Order Data Disclosure
Fixed in
Fixed in 2.4.7
CVSS
7.5 (high)
Published
2024-04-16
Title
HT Mega < 2.5.0 - Contributor+ Stored XSS via Image Grid Widget
Fixed in
Fixed in 2.5.0
CVSS
5.9 (medium)
Published
2024-04-16
Title
HT Mega < 2.4.7 - Contributor+ Stored XSS via size
Fixed in
Fixed in 2.4.7
CVSS
5.9 (medium)
Published
2024-04-16
Title
HT Mega < 2.4.7 - Contributor+ Stored XSS via Lightbox Widget
Fixed in
Fixed in 2.4.7
CVSS
5.9 (medium)
Published
2024-04-16
Title
HT Mega < 2.5.0 - Contributor+ Stored XSS via Countdown Widget
Fixed in
Fixed in 2.5.0
CVSS
5.9 (medium)
Published
2024-04-16
Title
HT Mega < 2.4.9 - Contributor+ Stored XSS via Accordion/FAQ
Fixed in
Fixed in 2.4.9
CVSS
5.9 (medium)
Published
2024-03-25
Title
HT Mega < 2.4.4 - Contributor+ Stored XSS
Fixed in
Fixed in 2.4.4
CVSS
5.9 (medium)
Published
2024-03-14
Title
HT Mega – Absolute Addons For Elementor < 2.4.7 - Contributor+ Directory Traversal
Fixed in
Fixed in 2.4.7
CVSS
8.8 (high)
Published
2024-03-12
Title
HT Mega – Absolute Addons For Elementor < 2.4.5 - Contributor+ Stored Cross-Site Scripting via Post Carousel Widget
Fixed in
Fixed in 2.4.5
CVSS
6.4 (medium)
Published
2024-03-12
Title
HT Mega < 2.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleTag
Fixed in
Fixed in 2.4.7
CVSS
6.4 (medium)
Published
2023-12-27
Title
HT Mega < 2.3.4 - Arbitrary Plugin/Theme Activation via CSRF
Fixed in
Fixed in 2.3.4
CVSS
4.3 (medium)
Published
2023-12-26
Title
HT Mega < 2.3.9 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.3.9
CVSS
7.1 (high)
Published
2021-04-13
Title
HT Mega - Absolute Addons for Elementor Page Builder < 1.5.7 - Contributor+ Stored XSS
Fixed in
Fixed in 1.5.7
CVSS
6.8 (medium)