Stored DOM-Based XSS Vulnerability in HT Mega Addons for Elementor

CVE-2026-111318

What is CVE-2026-111318?

The HT Mega Addons for Elementor plugin suffers from a Stored DOM-Based Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping. This flaw is present in all versions up to and including 3.2.7. Attackers can exploit this vulnerability by injecting arbitrary web scripts through the 'href' attribute found within the tags of the .htmega-tab-nav parameter. Successful exploitation may require additional conditions, such as having wpDiscuz installed with its rich editor capable of allowing specific HTML elements, as well as the presence of an HT Mega Tabs widget on the page where the malicious comment link is injected. When a user clicks on the manipulated link, the injected script executes in the user's browser.

References