CVE-2026-125807: WordPress HT Mega plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HTMega HT Mega ht-mega-for-elementor allows Stored XSS.This issue affects HT Mega: from n/a through 3.2.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.2.9
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates an attacker needs low-privileged access and user interaction. Exploitation is network-accessible and does not require a complex attack path.
What impact can successful exploitation have?
This is a stored XSS issue, so injected script may be retained and executed when another user views affected content. The provided vector rates confidentiality, integrity, and availability impact as low, with scope changed.
Which versions are affected?
HT Mega versions through 3.2.8 are affected. The available data does not identify a fixed version.