The HT Mega Addons plugin for WordPress is vulnerable to a stored DOM‑based cross‑site scripting flaw that operates through the href attribute of anchor tags in a Tab widget. If an attacker can cause the plugin to store malicious markup, that code will run in the browsers of any user who clicks the injected link, potentially allowing theft of session cookies, unauthorized actions performed as the victim, or the introduction of additional malware. The flaw has a CVSS score of 5.4, indicating moderate severity. The attack is carried out by an unauthenticated user who injects the payload through the plugin’s input mechanisms, and the script only executes when a target user follows the link. There is no direct remote code execution on the server side, but the client‑side impact can be significant.

WordPress installations that have installed devitemsllc HT Mega Addons for Elementor – Elementor Widgets & Template Builder version 3.2.7 or lower are affected. The vulnerability requires the plugin to be present together with a co‑installed plugin, such as wpDiscuz, that allows a rich editor to accept a[href] and span[class] tags, and a Tabs widget must exist on the same page as the comment area.

The vulnerability’s CVSS score of 5.4 signals moderate risk. EPSS data is not available and the flaw is not listed in CISA KEV, indicating there is currently no known widespread exploitation. However, the attack vector is clear: an unauthenticated user can inject malicious code through the HT Mega widget, which will be stored and later executed when any user visits the page and clicks the link. Because the injection requires a specific plugin configuration (wpDiscuz rich editor), the exploit’s success probability is reduced, but the potential impact remains significant for user accounts and site integrity.