DOM-Based Stored Cross-Site Scripting in HT Mega – Absolute Addons For Elementor Plugin

CVE-2025-1261

Summary

The HT Mega – Absolute Addons For Elementor plugin for WordPress exhibits a vulnerability that allows for DOM-based stored cross-site scripting. This issue arises due to inadequate input sanitization and insufficient output escaping within the plugin's Countdown widget, making it possible for authenticated users with contributor-level access and higher to inject malicious web scripts. These scripts can be executed whenever a user accesses the infected page, underscoring the need for prompt updates and stringent security measures.

References