HT Mega Addons for Elementor – Elementor Widgets & Template Builder

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   HT Mega Addons for Elementor – Elementor Widgets & Template Builder

Information

Software Type Plugin
Software Slug ht-mega-for-elementor (view on wordpress.org)
Software Status Active
Software Author devitemsllc
Software Website wphtmega.com
Software Downloads 5,931,822
Software Active Installs 70,000
Software Record Last Updated July 15, 2026

Showing 1-20 of 33 Vulnerabilities

Submit a Vulnerability
HT Mega Addons for Elementor – Elementor Widgets & Template Builder < 3.0.7 - Unauthenticated Information Exposure
5.3
CVE-2026-4106
Apr 24, 2026
Researcher: Chiao-Lin Yu (Steven Meow)
HT Mega – Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection
6.4
CVE-2025-13141
Nov 20, 2025
Researcher: Abu Hurayra (HurayraIIT)
HT Mega <= 2.9.0 - Missing Authorization
4.3
CVE-2025-54695
Jul 30, 2025
Researcher: Denver Jackson
HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure
4.3
CVE-2025-8401
Jul 30, 2025
Researcher: wesley (wcraft)
HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions
4.3
CVE-2025-8151
Jul 30, 2025
Researcher: wesley (wcraft)
HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions
4.3
CVE-2025-8068
Jul 30, 2025
Researcher: wesley (wcraft)
HT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
6.4
CVE-2025-1802
Mar 19, 2025
Researcher: zer0gh0st
HT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget
6.4
CVE-2025-1261
Mar 7, 2025
Researcher: Webbernaut
HT Mega – Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
6.4
CVE-2024-12599
Feb 10, 2025
Researcher: zer0gh0st
HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css
6.4
CVE-2024-12597
Feb 3, 2025
Researcher: Sean Murphy
HT Mega – Absolute Addons For Elementor <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_id
4.3
CVE-2024-8910
Sep 24, 2024
Researcher: Ankit Patel
HT Mega <= 2.5.7 - Authenticated (Contributor+) JSON File Directory Traversal
4.3
CVE-2024-38706
Jul 11, 2024
Researcher: Rafie Muhammad
HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
6.4
CVE-2024-5215
Jun 25, 2024
Researcher: stealthcopter
HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings
6.4
CVE-2024-5173
Jun 25, 2024
Researcher: João Pedro Soares de Alcântara
HT Mega – Absolute Addons For Elementor <= 2.4.5 - Authenticated (Contributor+) Directory Traversal
8.8
CVE-2024-1974
May 23, 2024
Researcher: Webbernaut
HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update
4.3
CVE-2024-4875
May 20, 2024
Researcher: 1337_Wannabe
HT Mega – Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-4876
May 20, 2024
Researcher: wesley (wcraft)
HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify
6.4
CVE-2024-3989
May 7, 2024
Researcher: Ngô Thiên An (ancorn_)
HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget
6.4
CVE-2024-3990
May 7, 2024
Researcher: wesley (wcraft)
HT Mega – Absolute Addons For Elementor <= 2.4.7 - Missing Authorization to Information Exposure
4.3
CVE-2024-32782
Apr 22, 2024
Researcher: Khalid
Title Status CVE ID CVSS Researchers Date
HT Mega Addons for Elementor – Elementor Widgets & Template Builder < 3.0.7 - Unauthenticated Information Exposure Patched CVE-2026-4106 5.3 Chiao-Lin Yu (Steven Meow) April 24, 2026
HT Mega – Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection Patched CVE-2025-13141 6.4 Abu Hurayra (HurayraIIT) November 20, 2025
HT Mega <= 2.9.0 - Missing Authorization Patched CVE-2025-54695 4.3 Denver Jackson July 30, 2025
HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure Patched CVE-2025-8401 4.3 wesley (wcraft) July 30, 2025
HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions Patched CVE-2025-8151 4.3 wesley (wcraft) July 30, 2025
HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions Patched CVE-2025-8068 4.3 wesley (wcraft) July 30, 2025
HT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets Patched CVE-2025-1802 6.4 zer0gh0st March 19, 2025
HT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget Patched CVE-2025-1261 6.4 Webbernaut March 7, 2025
HT Mega – Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget Patched CVE-2024-12599 6.4 zer0gh0st February 10, 2025
HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css Patched CVE-2024-12597 6.4 Sean Murphy February 3, 2025
HT Mega – Absolute Addons For Elementor <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_id Patched CVE-2024-8910 4.3 Ankit Patel September 24, 2024
HT Mega <= 2.5.7 - Authenticated (Contributor+) JSON File Directory Traversal Patched CVE-2024-38706 4.3 Rafie Muhammad July 11, 2024
HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets Patched CVE-2024-5215 6.4 stealthcopter June 25, 2024
HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings Patched CVE-2024-5173 6.4 João Pedro Soares de Alcântara June 25, 2024
HT Mega – Absolute Addons For Elementor <= 2.4.5 - Authenticated (Contributor+) Directory Traversal Patched CVE-2024-1974 8.8 Webbernaut May 23, 2024
HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update Patched CVE-2024-4875 4.3 1337_Wannabe May 20, 2024
HT Mega – Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-4876 6.4 wesley (wcraft) May 20, 2024
HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify Patched CVE-2024-3989 6.4 Ngô Thiên An (ancorn_) May 7, 2024
HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget Patched CVE-2024-3990 6.4 wesley (wcraft) May 7, 2024
HT Mega – Absolute Addons For Elementor <= 2.4.7 - Missing Authorization to Information Exposure Patched CVE-2024-32782 4.3 Khalid April 22, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation