Skip to content
Noroxi

HT Mega Addons for Elementor – Elementor Widgets & Template Builder

ht-mega-for-elementor · plugin

Known security vulnerabilities for HT Mega Addons for Elementor – Elementor Widgets & Template Builder. Find out in seconds which version runs on your site with WP Lens.

29 known vulnerabilities

1 critical · 2 with public exploit code · latest Aug 14, 2025

Vulnerabilities

  • CVE-2023-37999

    WordPress HT Mega Absolute Addons for Elementor plugin <= 2.2.0 - Unauthenticated Privilege Escalation vulnerability

    Critical 9.8

  • CVE-2024-38706

    WordPress HT Mega plugin <= 2.5.7 - JSON Path Traversal vulnerability

    High 8.8

  • CVE-2023-51529

    WordPress HT Mega Plugin <= 2.3.3 is vulnerable to Cross Site Request Forgery (CSRF)

    High 8.8

  • CVE-2023-6214

    HT Mega – Absolute Addons For Elementor <= 2.4.6 - Sensitive Information Exposure via purchased_products

    High 7.5

  • CVE-2024-32782

    WordPress HT Mega plugin <= 2.4.7 - Sensitive Data Exposure vulnerability

    Medium 6.5

  • CVE-2024-1974

    HT Mega – Absolute Addons For Elementor <= 2.4.5 - Authenticated (Contributor+) Directory Traversal

    Medium 6.5

  • CVE-2024-12599

    HT Mega – Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

    Medium 6.4

  • CVE-2023-50901

    WordPress HT Mega Plugin <= 2.3.8 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2025-54695

    WordPress HT Mega Plugin plugin <= 2.9.0 - Broken Access Control Vulnerability

    Medium 5.4

  • CVE-2025-1802

    HT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

    Medium 5.4

  • CVE-2025-1261

    HT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget

    Medium 5.4

  • CVE-2024-12597

    HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css

    Medium 5.4

  • CVE-2024-5215

    HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

    Medium 5.4

  • CVE-2024-5173

    HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings

    Medium 5.4

  • CVE-2024-4876

    HT Mega – Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-3990

    HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget

    Medium 5.4

  • CVE-2024-3989

    HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify

    Medium 5.4

  • CVE-2024-3308

    HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid Widget

    Medium 5.4

  • CVE-2024-3307

    HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

    Medium 5.4

  • CVE-2024-2790

    HT Mega – Absolute Addons For Elementor <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion/FAQ

    Medium 5.4

  • CVE-2024-2085

    HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size'

    Medium 5.4

  • CVE-2024-30182

    WordPress HT Mega – Absolute Addons For Elementor plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-1421

    HT Mega – Absolute Addons For Elementor <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Carousel Widget

    Medium 5.4

  • CVE-2024-1397

    HT Mega <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleTag

    Medium 5.4

  • CVE-2025-8401

    HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure

    Medium 4.3

  • CVE-2025-8151

    HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions

    Medium 4.3

  • CVE-2025-8068

    HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions

    Medium 4.3

  • CVE-2024-8910

    HT Mega – Absolute Addons For Elementor <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_id

    Medium 4.3

  • CVE-2024-4875

    HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update

    Medium 4.3

← Back to directory