blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-86788

MEDIUM 6.8 CVSS 3.1
Published
September 17, 2026
Last modified
September 18, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Description

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitrary JavaScript when the content is viewed, including by higher-privileged users who review or publish it.

Affected WordPress components

  • HT Mega Addons for Elementor – Elementor Widgets & Template Builder Plugin · ht-mega-for-elementor
    Confirmed match Active
    From 3.2.0 (including) to 3.2.6 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown HT Mega Addons for Elementor — From 3.2.0 (including) to 3.2.6 (excluding)

References

  • wpscan.com https://wpscan.com/vulnerability/20cad1a6-944e-40f8-8fbc-d97cd1e5bb4b/
  • nvd.nist.gov Official NVD record