CVE-2026-111318

MediumCVSS 5.4

Published: 29/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

28th percentile - higher than 28% of all known CVEs

Summary

The HT Mega Addons for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' attribute of <a> inside .htmega-tab-nav in all versions up to and including 3.2.7 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires a co-installed plugin such as wpDiscuz with its rich editor enabled, an HT Mega Tabs widget on the same page as the comment section, and a victim clicking the injected anchor link.

Risk Assessment

Allows unauthenticated attackers to execute arbitrary JavaScript in a user's browser, potentially leading to session theft, account takeover, or page content modification. Risk is elevated on sites with comments and HT Mega tab widgets.

Recommendation

Update the HT Mega Addons for Elementor plugin to a version later than 3.2.7 that includes the fix. Until then, consider disabling the HT Mega Tabs widget on pages with comment sections or restricting comment posting capabilities.

Other vulnerabilities in HT Mega Addons for Elementor

CVE-2026-11895Medium
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress up to version 3.1.1 is vulnerable to Stored Cross-Site Scripting via the Data Table 'display_options' setting. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

Original NVD description (English source)

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of <a> inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a co-installed plugin such as wpDiscuz with its rich editor enabled whose markup allowlist permits span[class] and a[href] storage, an HT Mega Tabs widget present on the same page as the comment section, and a victim user click on the injected anchor link.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS