The HT Mega – Absolute Addons for WPBakery Page Builder plugin has a DOM‑based cross‑site scripting weakness caused by improper neutralization of user input during web page generation. Against affected versions this flaw permits an attacker to inject malicious scripts through crafted input that is rendered without adequate sanitization. Successful exploitation could allow the attacker to execute code in the context of a victim’s browser, facilitating session hijacking, credential theft, or defacement of the site.

Any WordPress site that has the HT Mega – Absolute Addons for WPBakery Page Builder plugin installed with a version number of 1.0.9 or earlier. The vulnerability applies to all releases through that version boundary.

The CVSS score of 6.5 indicates a moderate severity vulnerability, while the EPSS score of less than 1% signals a very low likelihood of real‑world exploitation at present. The issue is not listed in the CISA KEV catalog. The attack vector is inferred to be via any user‑controllable input that the plugin renders without proper escaping, such as custom block content or widget fields. An attacker would supply a malicious payload that is then executed when the page loads in a victim’s browser.