Stored Cross-Site Scripting in HT Mega – Absolute Addons For Elementor Plugin by WordPress

CVE-2025-1802

What is CVE-2025-1802?

The HT Mega – Absolute Addons For Elementor plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This issue arises from inadequate sanitization of user inputs for parameters such as ‘marker_title’, 'notification_content', and 'stt_button_text'. Authenticated attackers with Contributor-level access or higher can exploit this flaw to insert harmful scripts that execute when users visit the manipulated pages. The vulnerability impacts all versions up to and including 2.8.3, although a partial patch was introduced in that version. Proper measures should be taken to ensure that input is thoroughly sanitized and output is correctly escaped to mitigate such threats.

References