Plugin security history

HT Mega Addons for Elementor – Elementor Widgets & Template Builder Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 33 vulnerability records associated with HT Mega Addons for Elementor – Elementor Widgets & Template Builder, published between 2021 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

33Total records

1Critical

2High

30Medium

0Low

0Informational

33Patched records

0Currently marked unpatched

2021-04-13First disclosure

2026-04-24Latest disclosure

33 of 33CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2021	1	1 records
2023	3	3 records
2024	19	19 records
2025	9	9 records
2026	1	1 records

Severity Breakdown

Severity	Records	Share
Critical	1	3%
High	2	6.1%
Medium	30	90.9%

Vulnerability-Type Breakdown

Cross-Site Scripting

20 records60.6%

First: 2021. Latest: 2025.

Missing Authorization

5 records15.2%

First: 2023. Latest: 2025.

Information Disclosure

4 records12.1%

First: 2024. Latest: 2026.

Path Traversal

3 records9.1%

First: 2024. Latest: 2025.

CSRF

1 record3%

First: 2023. Latest: 2023.

Patch Status

Patched: 33
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.0.7
3.0.1
2.9.1
2.9.2
2.8.4
2.8.3
2.8.2
2.7.7
2.6.6
2.5.8
2.5.6
2.5.3
2.5.1
2.4.8
2.4.9
2.5.0
2.4.7
2.4.4
2.4.5
2.3.4
2.3.9
2.2.1
1.5.7

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`[*, 3.0.7)`	HT Mega Addons for Elementor – Elementor Widgets & Template Builder < 3.0.7 - Unauthenticated Information Exposure	April 24, 2026	3.0.7	Medium
`*-3.0.0`	HT Mega – Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection	November 20, 2025	3.0.1	Medium
`*-2.9.0`	HT Mega <= 2.9.0 - Missing Authorization	July 30, 2025	2.9.1	Medium
`*-2.9.1`	HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions	July 30, 2025	2.9.2	Medium
`*-2.9.1`	HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure	July 30, 2025	2.9.2	Medium
`*-2.9.1`	HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions	July 30, 2025	2.9.2	Medium
`*-2.8.3`	HT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	March 19, 2025	2.8.4	Medium
`*-2.8.2`	HT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget	March 7, 2025	2.8.3	Medium
`*-2.8.1`	HT Mega – Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	February 10, 2025	2.8.2	Medium
`*-2.7.6`	HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css	February 3, 2025	2.7.7	Medium
`*-2.6.5`	HT Mega – Absolute Addons For Elementor <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_id	September 24, 2024	2.6.6	Medium
`*-2.5.7`	HT Mega <= 2.5.7 - Authenticated (Contributor+) JSON File Directory Traversal	July 11, 2024	2.5.8	Medium
`*-2.5.5`	HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	June 25, 2024	2.5.6	Medium
`*-2.5.5`	HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings	June 25, 2024	2.5.6	Medium
`*-2.4.6`	HT Mega – Absolute Addons For Elementor <= 2.4.5 - Authenticated (Contributor+) Directory Traversal	May 23, 2024	2.4.7	High
`*-2.5.2`	HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update	May 20, 2024	2.5.3	Medium
`*-2.5.2`	HT Mega – Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 20, 2024	2.5.3	Medium
`*-2.5.0`	HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget	May 7, 2024	2.5.1	Medium
`*-2.5.0`	HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify	May 7, 2024	2.5.1	Medium
`*-2.4.7`	HT Mega – Absolute Addons For Elementor <= 2.4.7 - Missing Authorization to Information Exposure	April 22, 2024	2.4.8	Medium
`*-2.4.9`	HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	April 16, 2024	2.5.0	Medium
`*-2.4.6`	HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widget	April 16, 2024	2.4.7	Medium
`*-2.4.6`	HT Mega – Absolute Addons For Elementor <= 2.4.6 - Sensitive Information Exposure via purchased_products	April 16, 2024	2.4.7	High
`*-2.4.8`	HT Mega – Absolute Addons For Elementor <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion/FAQ	April 16, 2024	2.4.9	Medium
`*-2.4.9`	HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid Widget	April 16, 2024	2.5.0	Medium

Selected source records

Latest Records

MediumCVE-2026-4106

HT Mega Addons for Elementor – Elementor Widgets & Template Builder < 3.0.7 - Unauthenticated Information Exposure

Published: April 24, 2026

Affected versions: [*, 3.0.7)
Patched versions: 3.0.7

Original Wordfence record

MediumCVE-2025-13141

HT Mega – Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection

Published: November 20, 2025

Affected versions: *-3.0.0
Patched versions: 3.0.1

Original Wordfence record

MediumCVE-2025-8151

HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions

Published: July 30, 2025

Affected versions: *-2.9.1
Patched versions: 2.9.2

Original Wordfence record

MediumCVE-2025-8401

HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure

Published: July 30, 2025

Affected versions: *-2.9.1
Patched versions: 2.9.2

Original Wordfence record

MediumCVE-2025-8068

HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions

Published: July 30, 2025

Affected versions: *-2.9.1
Patched versions: 2.9.2

Original Wordfence record

MediumCVE-2025-54695

HT Mega <= 2.9.0 - Missing Authorization

Published: July 30, 2025

Affected versions: *-2.9.0
Patched versions: 2.9.1

Original Wordfence record

MediumCVE-2025-1802

HT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

Published: March 19, 2025

Affected versions: *-2.8.3
Patched versions: 2.8.4

Original Wordfence record

MediumCVE-2025-1261

HT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget

Published: March 7, 2025

Affected versions: *-2.8.2
Patched versions: 2.8.3

Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-37999

HT Mega – Absolute Addons for Elementor <= 2.2.0 - Missing Authorization to Privilege Escalation

Published: July 7, 2023

Affected versions: [*, 2.2.1)
Patched versions: 2.2.1

Original Wordfence record

HighCVE-2024-1974

HT Mega – Absolute Addons For Elementor <= 2.4.5 - Authenticated (Contributor+) Directory Traversal

Published: May 23, 2024

Affected versions: *-2.4.6
Patched versions: 2.4.7

Original Wordfence record

HighCVE-2023-6214

HT Mega – Absolute Addons For Elementor <= 2.4.6 - Sensitive Information Exposure via purchased_products

Published: April 16, 2024

Affected versions: *-2.4.6
Patched versions: 2.4.7

Original Wordfence record

MediumCVE-2024-3989

HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify

Published: May 7, 2024

Affected versions: *-2.5.0
Patched versions: 2.5.1

Original Wordfence record

MediumCVE-2024-2085

HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size'

Published: April 16, 2024

Affected versions: *-2.4.6
Patched versions: 2.4.7

Original Wordfence record

MediumCVE-2024-12597

HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css

Published: February 3, 2025

Affected versions: *-2.7.6
Patched versions: 2.7.7

Original Wordfence record

MediumCVE-2024-12599

HT Mega – Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

Published: February 10, 2025

Affected versions: *-2.8.1
Patched versions: 2.8.2

Original Wordfence record

MediumCVE-2024-30182

HT Mega <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: March 25, 2024

Affected versions: *-2.4.3
Patched versions: 2.4.4

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory