CVE-2026-11895 in HT Mega Addons for Elementor Plugin
Summary
by MITRE • 09/30/2026
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'display_options' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified within the HT Mega Addons for Elementor plugin represents a significant security risk affecting WordPress environments utilizing versions up through 3.1.1. This specific flaw is categorized as a Stored Cross-Site Scripting, commonly referred to in industry standards such as CWE-80 or its updated iteration CWE-79 depending on the context of persistence and execution vector. The root cause lies in insufficient input sanitization and output escaping mechanisms applied specifically to the display_options setting within the Data Table widget component. Unlike reflected XSS where malicious scripts are executed immediately via a crafted URL, stored vulnerabilities persist by saving the injected payload into the application's database or configuration files. In this case, an attacker can embed arbitrary JavaScript code through the plugin’s administrative interface, which is then rendered and executed in the browser of any user who views the affected page containing the compromised Data Table widget.
The operational impact of this vulnerability extends beyond simple script execution to potential account compromise, session hijacking, and data exfiltration. Because the attack requires authenticated access with contributor-level privileges or higher, it targets users who have been granted a degree of trust within the WordPress ecosystem. Once an attacker successfully injects malicious scripts via the display_options parameter, these scripts become persistent on the site. Consequently, every visitor to the page containing the tainted widget will trigger the execution of the injected code in their browser environment. This allows attackers to steal administrative cookies, redirect users to phishing sites, deface web pages, or deploy further malware payloads such as cryptominers or keyloggers without requiring direct interaction with the attacker after the initial injection phase.
From a threat intelligence perspective, this vulnerability aligns closely with MITRE ATT&CK techniques related to Client-Side Scripting Injection and potentially Drive-by Compromise if combined with other exploits. The persistence mechanism inherent in stored XSS means that remediation is not merely about patching a single input field but requires addressing the broader security posture of how user-generated content is handled within dynamic WordPress plugins. Attackers often leverage such vulnerabilities to establish long-term access or amplify their reach across an organization’s digital footprint by targeting multiple users through a single compromised page, thereby increasing the blast radius significantly compared to non-persistent attacks.
Mitigation strategies must prioritize immediate patching of the HT Mega Addons plugin to version 3.1.2 or later where these sanitization and escaping issues have been addressed by the developers. In scenarios where updating is not immediately feasible, administrators should implement strict Content Security Policy headers to restrict script execution sources, although this may impact legitimate functionality depending on configuration. Additionally, enforcing role-based access control to limit who can edit pages containing Data Table widgets reduces the attack surface for potential contributors or higher-level users attempting exploitation. Regular security audits and code reviews focusing on input validation and output encoding practices are essential to prevent similar vulnerabilities in future updates or related plugins within the WordPress ecosystem.