CVE-2026-11895

MediumCVSS 6.4

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress up to version 3.1.1 is vulnerable to Stored Cross-Site Scripting via the Data Table 'display_options' setting. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

Risk Assessment

The risk involves potential session hijacking, data theft, or malware propagation within the trusted WordPress page context.

Recommendation

Immediately update the HT Mega Addons for Elementor plugin to the latest patched version. Additionally, restrict user privileges to the minimum necessary.

Other vulnerabilities in HT Mega Addons for Elementor

CVE-2026-111318Medium
The HT Mega Addons for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' attribute of <a> inside .htmega-tab-nav in all versions up to and including 3.2.7 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires a co-installed plugin such as wpDiscuz with its rich editor enabled, an HT Mega Tabs widget on the same page as the comment section, and a victim clicking the injected anchor link.

Original NVD description (English source)

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'display_options' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS