CVE-2026-86788 HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag
Contributors can inject arbitrary JavaScript via section headline tags in HT Mega Addons for Elementor, potentially compromising higher-privileged users.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-86788?
CVE-2026-86788 is a medium-severity cross-site scripting vulnerability in Unknown HT Mega Addons for Elementor, published on 17 Sep 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitrary JavaScript when the content is viewed, including by higher-privileged users who review or publish it.
Weakness: CWE-79
Which versions are affected by CVE-2026-86788?
How do I fix CVE-2026-86788?
No fix has been published for CVE-2026-86788 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-86788 being exploited?
There is no known exploitation of CVE-2026-86788 in the wild and no public exploit code.
Sources
Also known as GHSA-hgm3-7rq2-3rv9.