WordPress ht-mega-for-elementor has 22 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2024-1974 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, | high | 8.8 | <2.4.7 | 2.4.7 |
| CVE-2024-4875 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a mi | medium | 4.3 | <2.5.3 | 2.5.3 |
| CVE-2023-6214 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and | high | 7.5 | <2.4.7 | 2.4.7 |
| CVE-2024-1397 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all | medium | 6.4 | <2.4.7 | 2.4.7 |
| CVE-2024-3990 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tooltip & Popover Widg | medium | 6.4 | <2.5.1 | 2.5.1 |
| CVE-2025-8151 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 | medium | 4.3 | <2.9.2 | 2.9.2 |
| CVE-2024-3308 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid widget's at | medium | 6.4 | <2.5.0 | 2.5.0 |
| CVE-2024-5215 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all ve | medium | 6.4 | <2.5.6 | 2.5.6 |
| CVE-2025-8401 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and | medium | 4.3 | <2.9.2 | 2.9.2 |
| CVE-2024-4876 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘popover_header_text’ | medium | 6.4 | <2.5.3 | 2.5.3 |
| CVE-2024-3989 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Gallery Justi | medium | 6.4 | <2.5.1 | 2.5.1 |
| CVE-2024-12599 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown wid | medium | 6.4 | <=2.8.1 | – |
| CVE-2025-8068 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to an impro | medium | 4.3 | <2.9.2 | 2.9.2 |
| CVE-2024-3307 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown widget's att | medium | 6.4 | <2.5.0 | 2.5.0 |
| CVE-2024-1421 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘border_type’ attribut | medium | 6.4 | <=2.4.4 | – |
| CVE-2024-2085 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' value in severa | medium | 6.4 | <2.4.7 | 2.4.7 |
| CVE-2024-2790 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Accordion widget in all ve | medium | 6.4 | <2.4.9 | 2.4.9 |
| CVE-2024-12597 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_css' and 'inner | medium | 6.4 | <2.7.7 | 2.7.7 |
| CVE-2024-8910 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and | medium | 4.3 | <2.6.6 | 2.6.6 |
| CVE-2025-1802 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘marker_title’, 'notif | medium | 6.4 | <2.8.4 | 2.8.4 |
| CVE-2024-5173 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video player widget se | medium | 6.4 | <2.5.6 | 2.5.6 |
| CVE-2025-1261 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Cou | medium | 6.4 | <=2.8.2 | – |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked