The HT Mega – Absolute Addons For Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in the Image Grid widget's attributes due to inadequate input sanitization and output escaping. This allows authenticated users with contributor-level access or higher to inject arbitrary scripts that execute in the context of users viewing the compromised pages. The vulnerability affects all versions up to 2.4.9 and has a CVSS 3.1 base score of 6.4 (medium severity). No known exploits in the wild have been reported, and no patch or remediation details are currently available.

Successful exploitation allows an authenticated contributor or higher to inject malicious scripts that execute in the browsers of users who visit the affected pages. This can lead to information disclosure or other client-side impacts as indicated by the CVSS vector (confidentiality and integrity impacts, no availability impact). There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the vulnerable Image Grid widget if feasible.