HT Mega vulnerabilities | LiveThreat CVE Feed

Product

HT Mega

by HasThemes · last CVE Jul 31, 2025

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities30 In the news0 Timeline

Severity mix

Critical 1High 3Medium 26Low 0

Severity

All severities30 Critical1 High3 Medium26 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add HT Mega to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-37999	9.8	3%	May 17	WordPress HT Mega Absolute Addons for Elementor plugin <= 2.2.0 - Unauthenticated Privilege Escalation vulnerability Affected: through 2.2.0
CVE-2024-38706	8.8	1%	Jul 12	WordPress HT Mega plugin <= 2.5.7 - JSON Path Traversal vulnerability Affected: before 2.5.8
CVE-2023-51529	8.8	0%	Feb 29	WordPress HT Mega Plugin <= 2.3.3 is vulnerable to Cross Site Request Forgery (CSRF) Affected: before 2.3.4
CVE-2023-6214	7.5	1%	May 2	HT Mega – Absolute Addons For Elementor <= 2.4.6 - Sensitive Information Exposure via purchased_products Affected: before 2.4.7
CVE-2024-32782	6.5	1%	Apr 24	WordPress HT Mega plugin <= 2.4.7 - Sensitive Data Exposure vulnerability Affected: before 2.4.8
CVE-2024-1974	6.5	1%	Apr 9	HT Mega – Absolute Addons For Elementor <= 2.4.5 - Authenticated (Contributor+) Directory Traversal Affected: before 2.4.7
CVE-2024-12599	6.4	0%	Feb 11	HT Mega – Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget Affected: through 2.8.1
CVE-2023-50901	6.1	0%	Dec 29	WordPress HT Mega Plugin <= 2.3.8 is vulnerable to Cross Site Scripting (XSS) Affected: through 2.3.8
CVE-2025-1802	5.4	0%	Mar 20	HT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets Affected: before 2.8.4
CVE-2025-1261	5.4	0%	Mar 8	HT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget Affected: through 2.8.2
CVE-2024-12597	5.4	0%	Feb 4	HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css Affected: before 2.7.7
CVE-2024-5215	5.4	0%	Jun 26	HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets Affected: before 2.5.6
CVE-2024-5173	5.4	0%	Jun 26	HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings Affected: before 2.5.6
CVE-2024-4876	5.4	0%	May 21	HT Mega – Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: before 2.5.3
CVE-2024-3990	5.4	0%	May 9	HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget Affected: before 2.5.1
CVE-2024-3989	5.4	0%	May 9	HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify Affected: before 2.5.1
CVE-2024-3307	5.4	0%	May 2	HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget Affected: before 2.5.0
CVE-2024-2084	5.4	0%	May 2	HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widget Affected: before 2.4.7
CVE-2024-2790	5.4	0%	May 2	HT Mega – Absolute Addons For Elementor <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion/FAQ Affected: before 2.4.9
CVE-2024-3308	5.4	0%	May 2	HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid Widget Affected: before 2.5.0
CVE-2024-2085	5.4	0%	May 2	HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Affected: before 2.4.7
CVE-2024-30182	5.4	0%	Mar 27	WordPress HT Mega – Absolute Addons For Elementor plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability Affected: before 2.4.4
CVE-2024-1421	5.4	0%	Mar 12	HT Mega – Absolute Addons For Elementor <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Carousel Widget Affected: through 2.4.4
CVE-2024-1397	5.4	0%	Mar 12	HT Mega <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleTag Affected: before 2.4.7
CVE-2021-24261	5.4	1%	May 5	The “HT Mega – Absolute Addons for Elementor Page Builder” WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by… Affected: before 1.5.7
CVE-2025-8068	4.3	0%	Jul 31	HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions Affected: before 2.9.2
CVE-2025-8401	4.3	0%	Jul 31	HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure Affected: before 2.9.2
CVE-2025-8151	4.3	0%	Jul 31	HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions Affected: before 2.9.2
CVE-2024-8910	4.3	0%	Sep 25	HT Mega – Absolute Addons For Elementor <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_id Affected: before 2.6.6
CVE-2024-4875	4.3	1%	May 21	HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update Affected: before 2.5.3