HM
Product
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
26
CVEs
0
On KEV
7.5
Max CVSS
2
New 30D
Severity mix
Critical 0High 1Medium 25Low 0
Watch
Add HT Mega Addons for Elementor – Elementor Widgets & Template Builder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-6214 | 7.5 | May 2 | HT Mega – Absolute Addons For Elementor <= 2.4.6 - Sensitive Information Exposure via purchased_products Affected: through 2.4.6 |
| CVE-2024-1974 | 6.5 | Apr 9 | HT Mega – Absolute Addons For Elementor <= 2.4.5 - Authenticated (Contributor+) Directory Traversal Affected: through 2.4.6 |
| CVE-2026-11895 | 6.4 | Sep 30 | HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting Affected: through 3.1.1 |
| CVE-2025-13141 | 6.4 | Nov 21 | HT Mega – Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection Affected: through 3.0.0 |
| CVE-2024-12599 | 6.4 | Feb 11 | HT Mega – Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget Affected: through 2.8.1 |
| CVE-2026-111318 New | 5.4 | Oct 29 | HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink Affected: through 3.2.7 |
| CVE-2025-1802 | 5.4 | Mar 20 | HT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets Affected: through 2.8.3 |
| CVE-2025-1261 | 5.4 | Mar 8 | HT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget Affected: through 2.8.2 |
| CVE-2024-12597 | 5.4 | Feb 4 | HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css Affected: through 2.7.6 |
| CVE-2024-5215 | 5.4 | Jun 26 | HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets Affected: through 2.5.5 |
| CVE-2024-5173 | 5.4 | Jun 26 | HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings Affected: through 2.5.5 |
| CVE-2024-4876 | 5.4 | May 21 | HT Mega – Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 2.5.2 |
| CVE-2024-3990 | 5.4 | May 9 | HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget Affected: through 2.5.0 |
| CVE-2024-3989 | 5.4 | May 9 | HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify Affected: through 2.5.0 |
| CVE-2024-3307 | 5.4 | May 2 | HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget Affected: through 2.4.9 |
| CVE-2024-2084 | 5.4 | May 2 | HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widget Affected: through 2.4.6 |
| CVE-2024-2790 | 5.4 | May 2 | HT Mega – Absolute Addons For Elementor <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion/FAQ Affected: through 2.4.8 |
| CVE-2024-3308 | 5.4 | May 2 | HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid Widget Affected: through 2.4.9 |
| CVE-2024-2085 | 5.4 | May 2 | HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Affected: through 2.4.6 |
| CVE-2024-1421 | 5.4 | Mar 12 | HT Mega – Absolute Addons For Elementor <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Carousel Widget Affected: through 2.4.4 |
| CVE-2024-1397 | 5.4 | Mar 12 | HT Mega <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleTag Affected: through 2.4.6 |
| CVE-2025-8068 | 4.3 | Jul 31 | HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions Affected: through 2.9.1 |
| CVE-2025-8401 | 4.3 | Jul 31 | HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure Affected: through 2.9.1 |
| CVE-2025-8151 | 4.3 | Jul 31 | HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions Affected: through 2.9.1 |
| CVE-2024-8910 | 4.3 | Sep 25 | HT Mega – Absolute Addons For Elementor <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_id Affected: through 2.6.5 |
| CVE-2024-4875 | 4.3 | May 21 | HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update Affected: through 2.5.2 |
Showing 26