GCVE - cpe:2.3:a:unknown:ht_mega_addons_for

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:ht_mega_addons_for_elementor:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Ht Mega Addons For Elementor (`f2a05ef2-4d05-5eff-a688-1cd794afcae8`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-86788`	vulnerable	2026-10-13 12:28:46.219112	HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitrary JavaScript when the content is viewed, including by higher-privileged users who review or publish it. Published: 2026-09-17T06:00:10.546Z Updated: 2026-09-17T12:29:14.595Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/20cad1a6-944e-40f8-8fbc-d97cd1e5bb4b/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-4106`	vulnerable	2026-06-08 08:05:12.617553	HT Mega < 3.0.7 – Unauthenticated PII Disclosure The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some PII (such as full name, city, state and country) of customers who placed orders in the last 7 days Published: 2026-04-23T06:00:06.084Z Updated: 2026-04-23T15:29:25.910Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/9477ead2-3990-4aae-8e66-09ee2f4daa3e/	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.