CVE-2026-86788Wordfence

Vulnerability Summary

The HT Mega plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions 3.2.0 to 3.2.5. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity Level

MEDIUM(6.4)

Published Date

Sep 17, 2026

Last Modified

Sep 22, 2026

Exploitation Status

No confirmed exploitation yet

EPSS Score (30-Day)

0.24%Probability

Root Weakness (CWE)

CWE-79: Cross-site Scripting (XSS) ↗

The software does not neutralize user-controllable input before it is placed in output that is used as a web page.

CVSS v3.1 Base Metrics — Score 6.4 (MEDIUM)

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredLow

User InteractionNone

ScopeChanged

ConfidentialityLow

IntegrityLow

AvailabilityNone

Affected & Patched Versions

Affected Versions

HT Mega Addons for Elementor – Elementor Widgets & Template Builder 3.2.0 - 3.2.5

Patched Versions

HT Mega Addons for Elementor – Elementor Widgets & Template Builder 1

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.