The HT Mega – Absolute Addons For Elementor WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the 'size' parameter in multiple widgets is not properly sanitized or escaped, enabling authenticated users with contributor-level or higher privileges to inject arbitrary JavaScript code. This code executes in the context of any user who views the affected page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all plugin versions up to and including 2.4.6. The CVSS 3.1 base score is 6.4 (medium), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity. No patch or official fix has been documented in the provided data.

An attacker with contributor-level or higher permissions can inject persistent malicious scripts into pages via the vulnerable 'size' attribute in widgets. These scripts execute in the browsers of users who visit the infected pages, potentially compromising user sessions or data confidentiality and integrity. The vulnerability does not affect availability. There are no known active exploits reported. The impact is limited by the requirement for authenticated contributor-level access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting contributor-level permissions or disabling the HT Mega Addons for Elementor plugin to prevent exploitation. Monitoring for updates from the vendor is recommended. No vendor advisory or patch links are currently provided.