HT Mega Addons for Elementor – Elementor Widgets & Template Builder

HT Mega Addons for Elementor – Elementor Widgets & Template Builder has 33 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 33 are fixed as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 2 high. 2024 was the busiest year with 19 disclosures.

The most common weakness is Cross-Site Scripting, behind 20 of the records (61%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Missing Authorization.

Every one of the 33 issues recorded for HT Mega Addons for Elementor – Elementor Widgets & Template Builder has a vendor fix available, so running the current release closes all known holes.

19 independent researchers contributed these findings, most of them (8) reported by wesley (wcraft). HT Mega Addons for Elementor – Elementor Widgets & Template Builder is installed on roughly 70,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891022.11.2018Today13.04.20215.4HT Mega - Absolute Addons for Elementor Page Builder <= 1.5.5 - Contributor+ Stored Cross-Site Scripting CVSS 5.4 · 13.04.202107.07.20239.8HT Mega – Absolute Addons for Elementor <= 2.2.0 - Missing Authorization to Privilege Escalation CVSS 9.8 · 07.07.202326.12.20236.1HT Mega – Absolute Addons For Elementor <= 2.3.8 - Reflected Cross-Site Scripting CVSS 6.1 · 26.12.202327.12.20234.3HT Mega <= 2.3.3 - Cross-Site Request Forgery via Several Functions CVSS 4.3 · 27.12.202312.03.20246.4HT Mega <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleTag CVSS 6.4 · 12.03.20246.4HT Mega – Absolute Addons For Elementor <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Carousel Widget CVSS 6.4 · 12.03.202425.03.20246.4HT Mega <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 25.03.202416.04.20246.4HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid Widget CVSS 6.4 · 16.04.20246.4HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widget CVSS 6.4 · 16.04.20246.4HT Mega – Absolute Addons For Elementor <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion/FAQ CVSS 6.4 · 16.04.20246.4HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget CVSS 6.4 · 16.04.20246.4HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' CVSS 6.4 · 16.04.20247.5HT Mega – Absolute Addons For Elementor <= 2.4.6 - Sensitive Information Exposure via purchased_products CVSS 7.5 · 16.04.202422.04.20244.3HT Mega – Absolute Addons For Elementor <= 2.4.7 - Missing Authorization to Information Exposure CVSS 4.3 · 22.04.202407.05.20246.4HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget CVSS 6.4 · 07.05.20246.4HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify CVSS 6.4 · 07.05.202420.05.20246.4HT Mega – Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 20.05.20244.3HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update CVSS 4.3 · 20.05.202423.05.20248.8HT Mega – Absolute Addons For Elementor <= 2.4.5 - Authenticated (Contributor+) Directory Traversal CVSS 8.8 · 23.05.202425.06.20246.4HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings CVSS 6.4 · 25.06.20246.4HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets CVSS 6.4 · 25.06.202411.07.20244.3HT Mega <= 2.5.7 - Authenticated (Contributor+) JSON File Directory Traversal CVSS 4.3 · 11.07.202424.09.20244.3HT Mega – Absolute Addons For Elementor <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_id CVSS 4.3 · 24.09.202403.02.20256.4HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css CVSS 6.4 · 03.02.202510.02.20256.4HT Mega – Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget CVSS 6.4 · 10.02.202507.03.20256.4HT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget CVSS 6.4 · 07.03.202519.03.20256.4HT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets CVSS 6.4 · 19.03.202530.07.20254.3HT Mega <= 2.9.0 - Missing Authorization CVSS 4.3 · 30.07.20254.3HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions CVSS 4.3 · 30.07.20254.3HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure CVSS 4.3 · 30.07.20254.3HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions CVSS 4.3 · 30.07.202520.11.20256.4HT Mega – Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection CVSS 6.4 · 20.11.202524.04.20265.3HT Mega Addons for Elementor – Elementor Widgets & Template Builder < 3.0.7 - Unauthenticated Information Exposure CVSS 5.3 · 24.04.2026

Strategic Overview

Avg CVSSMedium
6.0/ 10
Patch Coverage100%
Open

0

Fixed

33

Get automatic notifications for all HT Mega Addons for Elementor – Elementor Widgets & Template Builder vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2023-37999

HT Mega – Absolute Addons for Elementor <= 2.2.0 - Missing Authorization to Privilege Escalation

Read the full analysis

Vulnerability Records

33 records
2026-04-24 00:00CVE-2026-4106
5.3
Medium
Chiao-Lin Yu (Steven Meow)Yes
2025-11-20 19:53CVE-2025-13141
6.4
Medium
Abu Hurayra (HurayraIIT)Yes
2025-07-30 00:00CVE-2025-54695
4.3
Medium
Denver JacksonYes
2025-07-30 00:00CVE-2025-8068
4.3
Medium
wesley (wcraft)Yes
2025-07-30 00:00CVE-2025-8401
4.3
Medium
wesley (wcraft)Yes
2025-07-30 00:00CVE-2025-8151
4.3
Medium
wesley (wcraft)Yes
2025-03-19 00:00CVE-2025-1802
6.4
Medium
zer0gh0stYes
2025-03-07 00:00CVE-2025-1261
6.4
Medium
WebbernautYes
2025-02-10 00:00CVE-2024-12599
6.4
Medium
zer0gh0stYes
2025-02-03 00:00CVE-2024-12597
6.4
Medium
Sean MurphyYes
Showing 1–10 of 33 reports
HT Mega Addons for Elementor – Elementor Widgets & Template Builder banner
Latestv3.2.5

HT Mega Addons for Elementor – Elementor Widgets & Template Builder

DevItems

Author

DevItems

4.1(65)
82/100
Last Updated
2026-09-02 (11d ago)
Active Installs
70,000+
Downloads
6,081,020
Requires WP
5.9+
Requires PHP
0+
Tested up to
WP 7.1
Created
2018-11-22 (8y ago)
Requires Plugins
elementor

Transform Your Elementor Page Builder into a Design Powerhouse Are you tired of Elementor’s limitations holding back your creativity? HT Mega is the ultimate Elementor addon plugin that unlocks your full design potential with 146+ professional widgets, AI Builder, theme builder, and 850+ ready-made blocks & sections. Join WordPress professionals who’ve already transformed their workflow and build stunning websites 73% faster than before. Live Demo | Documentation | Video Tutorials | Get Pro | Get Support 📹 Watch HT Mega in Action 🚀 Why Choose HT Mega? ✅ All-in-One Solution: Stop juggling multiple plugins. Get everything in one optimized package ✅ AI Builder: Generate full sections or entire multi-section pages from a prompt — choose from 6 AI engines (OpenAI, Claude, Gemini, DeepSeek, Kimi, Z.ai) ✅ 146+ Professional Widgets: From basic to advanced – we’ve got you covered ✅ Theme Builder Included: Design headers, footers, archives, and single posts ✅ 850+ Ready Blocks & Sections: Pre-designed sections across 100+ categories ✅ Lightning Fast: Modular loading ensures optimal performance ✅ Regular Updates: New features and improvements every 2 weeks 📊 By The Numbers (Combined Free & Pro features) 146+ Professional Widgets 14+ Powerful Modules 850+ Ready-Made Blocks & Sections 370+ Page Templates 20 Gutenberg Blocks 🎯 Complete Widget Collection 🆕 2026 Trend-Ready Section Collection (11) — NEW in 3.2.0 Built around 2026’s top design trends — Bento Grid, Glassmorphism, Dark Minimal, Aurora, and Neo-Brutalist — each of the 11 sections ships in all 5 styles with multiple layout variants, for both Elementor and Gutenberg (FSE): Hero: Landing page hero sections with headline, description, and CTA layouts — ▶ Watch demo About / Feature: Feature highlight sections with image + content columns Services: Service showcase sections in grid, list, or centered layouts — ▶ Watch demo Testimonials: Customer review sections in grid, masonry, or centered layouts Pricing Table: Plan comparison sections with monthly/annual billing toggle Stats / Counter: Animated number counter sections in row, grid, or bento layouts CTA Section: Call-to-action sections in centered, split, or banner layouts Team: Team member showcase sections in grid, list, or featured layouts FAQ: Accessible accordion FAQ sections in simple, grid, or boxed layouts Blog / Posts: WP_Query-powered post sections in grid, list, or featured layouts Contact: Contact form + info sections in split, centered, or info-only layouts General Widgets (39) Accordion (FAQ): Create frequently asked questions sections Banner: Design eye-catching promotional banners Blockquote: Style quotes and citations beautifully Brand: Display client logos and partner brands Button: Create stunning call-to-action buttons Call to Action: Build conversion-focused CTA sections Custom Carousel: Create any type of image carousel Data Table: Display data in responsive tables Double Button: Add dual button options Drop Caps: Style first letters of paragraphs Heading: Design beautiful headings with various styles Image Comparison: Show before/after images Image Grid: Create responsive image galleries Image Justify: Justified image gallery layouts Image Magnifier: Add zoom effects to images Image Masonry: Pinterest-style image layouts Info Box (Pro): Create information boxes with icons Inline Menu: Add horizontal navigation menus Modal: Create popup windows and modals News Ticker: Display scrolling news updates Notification: Show alert messages and notices Offcanvas: Hidden sidebar panels Page List (Pro): Display page list with various styles Panel Slider: Create panel-based sliders Popover: Add hover tooltips and popovers Pricing List: Manage your prices in one place and display them on your website Pricing Table: Professional pricing displays Progress Bar: Show skill levels and progress Scroll Image: Scrolling image showcase Scroll Navigation: One-page navigation dots Search: Create attractive and functional search bars for your website Services: Service showcase boxes Special Day Offer: Holiday and event promotions Switcher: Toggle between content Tab: Create tabbed content sections Team Member: Showcase team profiles Testimonial Carousel: Display customer reviews Toggle: Expandable content toggles Tooltip: Add helpful hover hints User Login: User login forms User Register: Registration forms Vertical Timeline: Timeline displays Video Player: Custom video players Weather: Weather information display Working Process: Step-by-step process display Creative Widgets (40) 360 Rotation (Pro): Interactive 360° product views Advanced Slider (Pro): Professional slider with effects Animated Heading: Text animations and effects Audio Player: Custom audio players Background Switcher (Pro): Dynamic backgrounds Blob Shape (Pro): Organic shape designs Business Hours: Display opening hours Calendly: Integrate Calendly scheduling Chart (Pro): Data visualization charts Copy Coupon Code (Pro): Click-to-copy coupons Countdown: Event countdown timers Counter: Animated number counters Event Box: Event information displays Event Calendar: Interactive calendars Filterable Gallery (Pro): Portfolio with filters Flip Box: 3D flip animations Flip Carousel (Pro): Carousel with flip effects Flip Switcher Pricing Table: Toggle pricing plans Google Map: Custom styled maps Icon Box (Pro): Icon with content boxes Image Marker: Hotspots on images Interactive Circle (Pro): Circular infographics Interactive Promo (Pro): Engaging promotions Light Box: Image and video popups Lottie (Pro): Lottie animations support Price Menu (Pro): Restaurant menu layouts Pricing Table Flip Box (Pro): Flip pricing cards Source Code (Pro): Code snippet display Team Carousel (Pro): Team member slider Video Gallery (Pro): Video portfolio grids Video Playlist (Pro): YouTube-style playlists Post Widgets (13) Post Carousel: Blog post sliders Post Grid: Grid blog layouts Post Grid Tab: Tabbed post categories Post Masonry (Pro): Masonry blog layouts Post Slider: Featured post sliders Post Timeline (Pro): Blog timeline layout Single Post: Single post display Archive Posts: Archive page builder Breadcrumbs: Navigation breadcrumbs Category List (Pro): Category displays Dynamic Gallery (Pro): Display your post content with filtering option Taxonomy Terms (Pro): Taxonomy display View All Widget Demos 🔥 Powerful Modules That Extend Elementor Free Modules (8) Theme Builder – Complete control over your WordPress site design Mega Menu Builder – Create stunning multi-level navigation menus Sales Notification – Boost conversions with live notification Wrapper Link – Make entire sections clickable Reading Progress Bar – Enhance user engagement Scroll To Top – Improve site navigation Floating Effects – Add eye-catching animations Post Duplicator – Clone content with one click Pro Modules (6) Parallax – Create stunning scroll effects Particles – Interactive background animations Conditional Display – Show/hide content based on conditions Advanced Sticky – Make any element sticky on scroll Custom CSS – Add custom styling per widget Cross-Domain Copy Paste – Copy elements between websites 🤖 AI Builder Describe what you want and let AI build it — right inside Elementor. Choose from 6 AI engines: OpenAI Anthropic Claude Google Gemini DeepSeek Kimi (Moonshot AI) Z.ai (GLM) Prompt-to-section: Type a description (e.g. “services section for a law firm, dark and serious”) and AI Builder generates a fully designed, ready-to-edit section using HT Mega’s section widgets. Prompt-to-page: Switch to “Build a full page” to generate an entire multi-section page — hero, features, testimonials, pricing, and more — from a single prompt. Improve existing content: Already have a section? Use AI to rewrite headlines, descriptions, and copy in place, directly on the widget fields. No more writer’s block, and no more starting from a blank canvas. 📁 Extensive Template Library 370+ Professional Page Templates across 43+ categories including: SaaS, Medical, Construction, Law Firm, Real Estate, Agency, Education, Corporate, Charity, Portfolio, Event, and many more! 850+ Ready Blocks & Sections organized in 100+ categories: Hero Sections Feature Grids Testimonials Pricing Tables Contact Forms Team Layouts And much more! Browse All Templates 👥 Who Is HT Mega For? Web Designers: Create stunning designs 73% faster Developers: Clean code with hooks and filters Agencies: Manage multiple projects efficiently Business Owners: Build professional sites without coding Freelancers: Deliver more projects in less time ✨ What Makes HT Mega Different? Complete Solution: Unlike others requiring multiple plugins, HT Mega provides everything Performance Optimized: Modular loading ensures your site stays fast Regular Updates: New features and improvements every 2 weeks Dedicated Support: Professional team ready to help Best Value: Save hundreds compared to buying multiple addons 📚 Documentation & Support Extensive Documentation with step-by-step guides Video Tutorial Library on YouTube Privacy Policy – Your data is safe with us Missing Any Feature? – Let us know what you need 🔥 WHAT’S NEXT Explore our other WordPress solutions to enhance your website: 🛍️ WooLentor – Transform your WooCommerce store with 125+ widgets, 85+ Gutenberg blocks, 34+ Modules and 110+ templates. Features include wishlist, product compare, variation swatches, and multi-step checkout. The ultimate alternative to ShopReady, Kadence, and JetWidgets. 📢 HashBar – Create unlimited notification bars for announcements, promotions, and alerts. Fully customizable with multiple display options. ✉️ Extensions for CF7 – Extend Contact Form 7 with database storage, conditional fields, and Mailchimp integration. Capture and manage leads effectively. 💼 Whols – Professional wholesale pricing solution for WooCommerce. Set wholesale prices, minimum requirements, and custom registration fields. Alternative to Wholesale Suite and B2BKing. 📊 JustTables – Display products in customizable tables with pre-built columns. Perfect for catalogs and bulk ordering. 🎨 Swatchly – Add beautiful color, image, and label swatches to product variations. Enhance the shopping experience with visual selection options. 📧 HT Contact Form – Seamlessly integrate Contact Form 7 with Elementor. Drag, drop, and style your forms with ease. Source Code You can find the complete source code for this plugin on GitHub. 🔗 View on GitHub Bundled jQuery Countdown (assets/js/jquery-countdown.min.js) is third-party; source upstream at https://github.com/hilios/jQuery.countdown. External services Used only when the related widget/feature is active. Not required for core functionality. AI Builder — sends prompt + page context to chosen provider: * OpenAI (Terms/Privacy) · Anthropic (Terms/Privacy) · Gemini (Terms/Privacy) · DeepSeek (Terms/Privacy) · Kimi (Terms/Privacy) · Z.ai (Terms/Privacy) Needs admin-supplied API key. Weather widget — location sent to OpenWeatherMap (Privacy). Twitter/X Feed — OAuth fetch of tweets/avatars via X API (Privacy). Instagram Feed — media fetched via Instagram Graph API (Privacy). Social share counters — queries share/like count for current URL: Facebook/Priv · Pinterest/Priv · Reddit/Priv · Tumblr/Priv · Buffer/Priv · Yahoo (Surfingbird via YQL) Terms/Priv Deactivation feedback — site IP sent to ip-api.com to route survey by region.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C