This vulnerability involves improper neutralization of input in the HT Mega – Absolute Addons for WPBakery Page Builder plugin, which allows stored cross-site scripting (XSS) attacks. Specifically, untrusted input is not properly sanitized before being included in web pages, enabling attackers with low privileges to inject malicious scripts that execute in the context of other users. The issue affects all versions up to and including 1.0.8. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low to low respectively. No patch or official remediation guidance is currently available.

Successful exploitation of this vulnerability could allow an attacker with low privileges to inject and execute arbitrary scripts in the context of other users, potentially leading to information disclosure, modification of data, or disruption of service. The impact is rated medium severity with partial impacts on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider limiting privileges of users who can input data into the affected plugin and apply web application firewall (WAF) rules to detect and block XSS payloads related to this plugin. Monitor official HT Plugins communications for updates and patches.