HT Mega
DevItems
Developer
3.2.8
Latest version
60,000
Installations
No date
Last updated
Vulnerability history
0 present
36 patched
6 Mitigation rules
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability<= 3.1.129/09/2026
- Contributor+ Stored XSS vulnerability3.2.0-3.2.517/09/2026
- Unauthenticated PII Disclosure vulnerability< 3.0.724/04/2026
- WordPress HT Mega - Absolute Addons For Elementor plugin <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widget vulnerability<= 2.4.602/02/2026
- WordPress HT Mega - Absolute Addons For Elementor plugin <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid Widget vulnerability<= 2.4.902/02/2026
- Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify vulnerability<= 2.5.002/02/2026
- WordPress HT Mega - Absolute Addons For Elementor plugin <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings vulnerability<= 2.5.502/02/2026
- Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection vulnerability<= 3.0.020/11/2025
- Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions vulnerability<= 2.9.131/07/2025
- Authenticated (Author+) Sensitive Information Exposure vulnerability<= 2.9.131/07/2025
- Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions vulnerability<= 2.9.131/07/2025
- Broken Access Control Vulnerability<= 2.9.030/07/2025
- Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability<= 2.8.320/03/2025
- Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget vulnerability<= 2.8.208/03/2025
- Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget vulnerability<= 2.8.110/02/2025
- Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css vulnerability<= 2.7.603/02/2025
- Authenticated (Contributor+) Sensitive Information Exposure via template_id vulnerability<= 2.6.525/09/2024
- JSON Path Traversal vulnerability<= 2.5.711/07/2024
- Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability<= 2.5.526/06/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability<= 2.5.221/05/2024
- Missing Authorization to Options Update vulnerability<= 2.5.221/05/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget vulnerability<= 2.5.008/05/2024
- Sensitive Data Exposure vulnerability<= 2.4.722/04/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion/FAQ vulnerability<= 2.4.817/04/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability<= 2.4.617/04/2024
- Sensitive Information Exposure via purchased_products vulnerability<= 2.4.617/04/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability<= 2.4.917/04/2024
- Cross Site Scripting (XSS) vulnerability<= 2.4.325/03/2024
- Authenticated (Contributor+) Directory Traversal vulnerability<= 2.4.614/03/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via titleTag vulnerability<= 2.4.612/03/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via Post Carousel Widget vulnerability<= 2.4.412/03/2024
- Cross Site Request Forgery (CSRF) vulnerability<= 2.3.327/12/2023
- Reflected Cross Site Scripting (XSS) vulnerability<= 2.3.826/12/2023
- Unauthenticated Privilege Escalation vulnerability<= 2.2.014/07/2023
- SQL injection (SQLi) vulnerability<= 1.6.920/12/2021
- Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities<= 1.5.513/04/2021