Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-30
HT Mega Addons for Elementor - Security Vulnerability (CVE-2026-11895)
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'display_options' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
HT Mega Addons for Elementor
CVE-2026-11895
Risk Score
Threat Entry
Updated 2026-09-18
HT Mega Addons for Elementor - Security Vulnerability (CVE-2026-86788)
The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitrary JavaScript when the content is viewed, including by higher-privileged users who review or publish it.
PLUGIN
HT Mega Addons for Elementor
CVE-2026-86788
Risk Score
Threat Entry
Updated 2026-06-17
HT Mega Addons for Elementor - Security Vulnerability (CVE-2026-4106)
The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some PII (such as full name, city, state and country) of customers who placed orders in the last 7 days
PLUGIN
HT Mega Addons for Elementor
CVE-2026-4106
Risk Score