CVE-2026-86788: HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag

Q: Which users can exploit this issue?

Users with contributor-level access or higher can exploit it by storing a crafted section headline tag name in affected widgets or blocks. The JavaScript executes when the affected content is viewed, including by higher-privileged users reviewing or publishing the content.

Q: Which versions are affected and what version fixes it?

HT Mega Addons for Elementor versions 3.2.0 through 3.2.5 are affected. Version 3.2.6 or later fixes the issue.

Published Sep 17, 2026

Updated

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitrary JavaScript when the content is viewed, including by higher-privileged users who review or publish it.

Affected Software

2 affected components

HT Mega Addons for Elementor>3.2.0<=3.2.5

HT Mega Addons for Elementor<3.2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade HT Mega Addons for Elementor (WordPress plugin) to a version that resolves this vulnerability.
Fixed in 3.2.6

Event History

Sep 17, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

Users with contributor-level access or higher can exploit it by storing a crafted section headline tag name in affected widgets or blocks. The JavaScript executes when the affected content is viewed, including by higher-privileged users reviewing or publishing the content.

Which versions are affected and what version fixes it?

HT Mega Addons for Elementor versions 3.2.0 through 3.2.5 are affected. Version 3.2.6 or later fixes the issue.