Stored Cross-Site Scripting in HT Mega – Absolute Addons For Elementor Plugin

CVE-2024-2790

Summary

The HT Mega – Absolute Addons For Elementor plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through its Accordion widget. This flaw arises from inadequate input sanitization and output escaping of user-supplied attributes. As a result, attackers with contributor-level access and above can inject malicious web scripts into pages. These scripts will execute when users access the compromised pages, potentially leading to unauthorized actions and data breaches.

References