The HT Mega – Absolute Addons For Elementor plugin contains a stored XSS vulnerability that allows authenticated users with Contributor or higher access to inject arbitrary scripts through the marker_title, notification_content and stt_button_text parameters. When a victim opens a page containing the injected content, the stored script executes in the victim’s browser, enabling data theft, session hijacking, or defacement. The weakness is a classic case of insufficient input sanitization leading to CWE‑79.

WordPress sites running the HT Mega – Absolute Addons For Elementor plugin by devitemsllc, all versions up to and including 2.8.3. The plugin adds widgets and templates to Elementor and is accessible via the WordPress administration interface.

The CVSS score of 6.4 classifies this as a moderate severity issue, but the EPSS score of less than 1 % indicates low likelihood of active exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have authenticated Contributor access and to modify widget parameters within the plugin’s editor. Successful exploitation results in client‑side script execution on any user who views the affected page.