CVE-2026-86788

Name of the Vulnerable Software and Affected Versions HT Mega Addons for Elementor versions prior to 3.2.6

Description Users with contributor-level access and above can store a crafted HTML tag name used to render section headlines in several widgets and blocks. Because the plugin does not restrict these tag names to a safe allowlist, this can lead to stored Cross-Site Scripting (XSS), where arbitrary JavaScript is executed when the content is viewed by other users, including those with higher privileges who review or publish the content.

Recommendations Update to version 3.2.6 or later.