The HT Mega Addons for Elementor WordPress plugin, versions 3.2.0 through 3.2.5, allows contributors to specify an arbitrary HTML tag name for a section headline. Because this tag name is not validated against a whitelist, a crafted tag can embed JavaScript that executes when the page is rendered. This results in a stored cross‑site scripting vulnerability that enables an attacker to run arbitrary scripts in the browser context of anyone who views the affected content, potentially stealing credentials, defacing the site, or loading malicious payloads.

HT Mega Addons for Elementor plugin for WordPress, versions 3.2.0 to 3.2.5. Users with contributor‑level or higher access can create the vulnerable content; users of any privilege level can trigger the stored payload when viewing the affected page.

The CVSS score of 6.8 indicates medium severity. The EPSS value of less than 1% suggests a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to have contributor privilege to insert the malicious tag, but once stored, any visitor to the page—including administrators—will be exposed to the JavaScript. The vulnerability is externally reachable via the web interface and can be abused with standard client‑side attacks.