The HT Mega – Absolute Addons For Elementor plugin contains a DOM‑based stored cross‑site scripting flaw in its Countdown widget. User‑supplied attributes are not sanitized, allowing a contributor‑level attacker to inject JavaScript that is stored with the page. When any visitor loads the affected page, the script runs in the visitor’s browser. The description does not state specific downstream effects; based on common XSS outcomes, one could infer that an attacker might steal information or deface the site, but these results are not explicitly documented here.

The vulnerability affects the HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin by devitemsllc. All versions up to and including 2.8.2 are vulnerable; version 2.8.3 and later contain the fix.

The CVSS score of 6.4 indicates medium severity, and the EPSS score of less than 1 % implies a low probability of exploitation in the wild. Because the flaw requires authenticated contributor-level access to inject the payload, an attacker must first obtain that role or compromise an account with it, then the stored script is delivered to every user who opens the page. The vulnerability is not yet listed in the CISA KEV catalog.