HT Mega
DevItems
Developer
3.0.6
Latest version
80,000
Installations
No date
Last updated
Vulnerability history
0 present
33 patched
5 Mitigation rules
- WordPress HT Mega - Absolute Addons For Elementor plugin <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widget vulnerability<= 2.4.6Feb 2, 2026
- WordPress HT Mega - Absolute Addons For Elementor plugin <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid Widget vulnerability<= 2.4.9Feb 2, 2026
- Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify vulnerability<= 2.5.0Feb 2, 2026
- WordPress HT Mega - Absolute Addons For Elementor plugin <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings vulnerability<= 2.5.5Feb 2, 2026
- Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection vulnerability<= 3.0.0Nov 20, 2025
- Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions vulnerability<= 2.9.1Jul 31, 2025
- Authenticated (Author+) Sensitive Information Exposure vulnerability<= 2.9.1Jul 31, 2025
- Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions vulnerability<= 2.9.1Jul 31, 2025
- Broken Access Control Vulnerability<= 2.9.0Jul 30, 2025
- Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability<= 2.8.3Mar 20, 2025
- Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget vulnerability<= 2.8.2Mar 8, 2025
- Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget vulnerability<= 2.8.1Feb 10, 2025
- Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css vulnerability<= 2.7.6Feb 3, 2025
- Authenticated (Contributor+) Sensitive Information Exposure via template_id vulnerability<= 2.6.5Sep 25, 2024
- JSON Path Traversal vulnerability<= 2.5.7Jul 11, 2024
- Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability<= 2.5.5Jun 26, 2024
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability<= 2.5.2May 21, 2024
- Missing Authorization to Options Update vulnerability<= 2.5.2May 21, 2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget vulnerability<= 2.5.0May 8, 2024
- Sensitive Data Exposure vulnerability<= 2.4.7Apr 22, 2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion/FAQ vulnerability<= 2.4.8Apr 17, 2024
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability<= 2.4.6Apr 17, 2024
- Sensitive Information Exposure via purchased_products vulnerability<= 2.4.6Apr 17, 2024
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability<= 2.4.9Apr 17, 2024
- Cross Site Scripting (XSS) vulnerability<= 2.4.3Mar 25, 2024
- Authenticated (Contributor+) Directory Traversal vulnerability<= 2.4.6Mar 14, 2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via titleTag vulnerability<= 2.4.6Mar 12, 2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via Post Carousel Widget vulnerability<= 2.4.4Mar 12, 2024
- Cross Site Request Forgery (CSRF) vulnerability<= 2.3.3Dec 27, 2023
- Reflected Cross Site Scripting (XSS) vulnerability<= 2.3.8Dec 26, 2023
- Unauthenticated Privilege Escalation vulnerability<= 2.2.0Jul 14, 2023
- SQL injection (SQLi) vulnerability<= 1.6.9Dec 20, 2021
- Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities<= 1.5.5Apr 13, 2021