{"id":"CVE-2026-125807","kind":"vulnerability","aliases":["CVE-2026-125807"],"related":[],"title":"HT Mega for Elementor: stored XSS lets attackers inject scripts into pages","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HTMega HT Mega ht-mega-for-elementor allows Stored XSS.This issue affects HT Mega: from n/a through 3.2.8.","summary":"HT Mega, a WordPress addon for Elementor, has a stored cross-site scripting flaw in versions through 3.2.8. An attacker who can store content on a page can run scripts in other visitors' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ht-mega-for-elementor","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["elementor","ht-mega","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed HT Mega for Elementor (ht-mega-for-elementor) plugin version in the WordPress admin plugin list, and see if it is `3.2.8` or earlier.","fix":"- Versions above `3.2.8` are reported as affected through that release; the fixed version is unknown from the sources.","status":"open","published_at":"2026-11-13T15:17:40+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","triaged_at":"2026-11-13T15:48:50+00:00","updated_at":"2026-11-13T15:48:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T15:48:50Z","model":"claude-haiku-5-5","output":{"fix":"- Versions above `3.2.8` are reported as affected through that release; the fixed version is unknown from the sources.","reach":"internet","title":"HT Mega for Elementor: stored XSS lets attackers inject scripts into pages","impact":"medium","summary":"HT Mega, a WordPress addon for Elementor, has a stored cross-site scripting flaw in versions through 3.2.8. An attacker who can store content on a page can run scripts in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","ht-mega","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitors' browsers and can steal sessions","analyst_note":"Confirm the fixed version and required privileges from the NVD entry or the plugin vendor's changelog.","how_to_check":"- Check the installed HT Mega for Elementor (ht-mega-for-elementor) plugin version in the WordPress admin plugin list, and see if it is `3.2.8` or earlier.\n- unknown","plain_action":"","product_name":"ht-mega-for-elementor","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the HT Mega for Elementor WordPress plugin at version 3.2.8 or earlier are exposed. The sources do not say which roles can store the malicious input, so unknown whether an attacker needs an account.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000744,"input_tokens":4552,"output_tokens":577,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125807':15A,18A '-2026':14A,17A '3.2.8':51B,100C 'addon':37B 'affect':94C 'allow':90C 'attack':8A,53B 'browser':67B 'content':57B 'cross':44B,77C 'cross-sit':43B,76C 'cve':13A,16A 'elementor':4A,23A,24B,39B,89C 'flaw':47B 'for':22A 'generat':75C 'host':31B 'ht':1A,20A,26B,33B,83C,86C,95C 'ht-mega':25B 'ht-mega-for-elementor':19A,85C 'htmega':82C 'improp':68C 'inject':9A 'input':71C 'issu':93C 'let':7A 'mega':2A,21A,27B,34B,84C,87C,96C 'n/a':98C 'neutral':69C 'packag':28B 'page':12A,60B,74C 'run':62B 'script':10A,46B,63B,79C 'self':30B 'self-host':29B 'site':45B,78C 'store':5A,42B,56B,91C 'version':49B 'visitor':66B 'vulner':80C 'web':73C 'wordpress':32B,36B 'xss':6A 'xss.this':92C","nicknames":[],"mitigations":[],"who_affected":"Sites running the HT Mega for Elementor WordPress plugin at version 3.2.8 or earlier are exposed. The sources do not say which roles can store the malicious input, so unknown whether an attacker needs an account.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["htmegaforelementor"],"ptokens":["elementor","for","ht","mega"],"labels":["elementor","htmega","medium","package","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-125807':15A,18A '-2026':14A,17A 'attack':8A 'cve':13A,16A 'elementor':4A,23A 'for':22A 'ht':1A,20A 'ht-mega-for-elementor':19A 'inject':9A 'let':7A 'mega':2A,21A 'page':12A 'script':10A 'store':5A 'xss':6A","search_b":"'3.2.8':51B 'addon':37B 'attack':53B 'browser':67B 'content':57B 'cross':44B 'cross-sit':43B 'elementor':24B,39B 'flaw':47B 'host':31B 'ht':26B,33B 'ht-mega':25B 'mega':27B,34B 'packag':28B 'page':60B 'run':62B 'script':46B,63B 'self':30B 'self-host':29B 'site':45B 'store':42B,56B 'version':49B 'visitor':66B 'wordpress':32B,36B","search_c":"'3.2.8':100C 'affect':94C 'allow':90C 'cross':77C 'cross-sit':76C 'elementor':89C 'generat':75C 'ht':83C,86C,95C 'ht-mega-for-elementor':85C 'htmega':82C 'improp':68C 'input':71C 'issu':93C 'mega':84C,87C,96C 'n/a':98C 'neutral':69C 'page':74C 'script':79C 'site':78C 'store':91C 'vulner':80C 'web':73C 'xss.this':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125807","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125807","severity":null,"published_at":"2026-11-13T15:17:40+00:00","modified_at":"2026-11-13T15:17:40+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","fetched_at":"2026-11-13T15:46:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}