CVE-2026-111318

Name of the Vulnerable Software and Affected Versions HT Mega Addons for Elementor – Elementor Widgets & Template Builder versions prior to 3.2.8

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the href attribute of <a> inside .htmega-tab-nav parameter, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page. Successful exploitation requires a co-installed plugin like wpDiscuz with its rich editor enabled (permitting span[class] and a[href] storage), the presence of an HT Mega Tabs widget on the same page as the comment section, and a victim clicking the injected anchor link.

Recommendations Update HT Mega Addons for Elementor – Elementor Widgets & Template Builder to version 3.2.8 or later.