CVE-2026-111318 in Ht Mega Addons for Elementor Plugin
Summary
by MITRE • 10/29/2026
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of <a> inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a co-installed plugin such as wpDiscuz with its rich editor enabled whose markup allowlist permits span[class] and a[href] storage, an HT Mega Tabs widget present on the same page as the comment section, and a victim user click on the injected anchor link.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in the HT Mega Addons for Elementor plugin represents a significant security risk within WordPress environments that utilize this specific suite of widgets and template builders. This flaw is classified as a Stored DOM-Based Cross-Site Scripting issue, which differs from traditional reflected XSS by persisting on the target server before being delivered to victims. The root cause lies in insufficient input sanitization and output escaping mechanisms when handling user-supplied data within the href attribute of anchor tags located inside elements with the class htmega-tab-nav. This technical deficiency allows malicious actors to inject arbitrary JavaScript code that becomes part of the page content stored on the server, rather than merely appearing temporarily in a URL or request parameter.
The operational impact of this vulnerability is severe because it enables unauthenticated attackers to execute scripts in the context of any user who views the affected page. Unlike many other vulnerabilities that require administrative privileges or specific configuration states, this flaw can be exploited by anyone with access to comment sections on pages where both HT Mega Tabs widgets and compatible commenting plugins are active. The attack vector relies heavily on social engineering tactics, specifically requiring a victim user to click on an injected anchor link within the comments section of a page containing the vulnerable widget structure. Once clicked, the malicious script executes in the victim's browser session, potentially leading to account takeover, session hijacking, defacement, or redirection to phishing sites.
Successful exploitation is contingent upon specific environmental conditions that must be present simultaneously on the target WordPress installation. First, there must be a co-installed plugin such as wpDiscuz with its rich editor feature enabled. This particular configuration allows for the storage of HTML markup including span elements with class attributes and anchor tags with href attributes, which serves as the vehicle for injecting the malicious payload. Second, an HT Mega Tabs widget must be present on the same page where the comment section is located. The interaction between these two components creates the specific DOM structure that fails to properly sanitize or escape the injected content during rendering. Without this precise combination of plugins and configurations, the attack vector remains inactive, highlighting the importance of understanding plugin interdependencies in complex WordPress deployments.
From a classification perspective, this vulnerability aligns with CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. More specifically, it falls under CWE-83 for Stored XSS and CWE-1064 for Index Out of Bounds or similar input handling errors depending on the exact parsing logic failure within the DOM manipulation process. In terms of adversary tactics, this exploit maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically through JavaScript execution in a browser context. It also relates to T1189 Drive-by Compromise if used for malware delivery or T1204 User Execution when relying on the victim clicking the link.
Mitigation strategies should focus primarily on immediate patching of the HT Mega Addons plugin to version 3.2.8 or later, where these sanitization and escaping issues have been addressed by the developers. Administrators must ensure that all WordPress plugins are kept up to date to minimize the attack surface presented by known vulnerabilities in third-party extensions. Additionally, organizations should review their use of rich text editors in comment sections, particularly those like wpDiscuz, and consider restricting allowed HTML tags if possible through configuration settings or additional security plugins that enforce stricter allowlists for user-generated content. Implementing a Web Application Firewall with robust XSS detection rules can provide an additional layer of defense by blocking malicious payloads before they are stored or rendered. Regular security audits focusing on plugin compatibility and input validation practices across the entire WordPress ecosystem will further reduce the likelihood of similar vulnerabilities being exploited in future updates.