Ht Mega Addons For Elementor Elementor Widgets Template Builder
Monthly
Stored cross-site scripting in the HT Mega Addons for Elementor - Elementor Widgets & Template Builder WordPress plugin (all versions up to and including 3.1.1) lets an authenticated attacker with contributor-level access or higher inject arbitrary JavaScript into a page through the Data Table widget's 'display_options' setting. The payload is persisted and then executes in the browser of any visitor - including administrators - who views the affected page, and because the CVSS scope is changed (S:C), the injected script runs in the context of the site's origin rather than a sandboxed component. The primary limiting factor is the prerequisite of a pre-existing contributor-or-higher account, so realistically exposed sites are those that permit untrusted users to register or otherwise obtain contributor privileges; no public exploit code has been identified at time of analysis and the issue is not a confirmed actively exploited (CISA KEV) vulnerability.
Stored cross-site scripting in the HT Mega Addons for Elementor - Elementor Widgets & Template Builder WordPress plugin (all versions up to and including 3.1.1) lets an authenticated attacker with contributor-level access or higher inject arbitrary JavaScript into a page through the Data Table widget's 'display_options' setting. The payload is persisted and then executes in the browser of any visitor - including administrators - who views the affected page, and because the CVSS scope is changed (S:C), the injected script runs in the context of the site's origin rather than a sandboxed component. The primary limiting factor is the prerequisite of a pre-existing contributor-or-higher account, so realistically exposed sites are those that permit untrusted users to register or otherwise obtain contributor privileges; no public exploit code has been identified at time of analysis and the issue is not a confirmed actively exploited (CISA KEV) vulnerability.