Is CVE-2026-86788 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86788 being exploited in the wild.

How severe is CVE-2026-86788?

Medium severity, with a CVSS score of 6.8, published 17 September 2026.

Which products and versions are affected?

HT Mega Addons for Elementor before 3.2.6.

Is there a fix for CVE-2026-86788?

A patch was published on 2026-09-15: Fixed in version 3.2.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86788 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86788?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86788: HT Mega Addons for Elementor stored XSS in section headline tag

CVE-2026-86788 · Severity: medium · CVSS 6.8 · Published 2026-09-17

HT Mega Addons for Elementor is a WordPress plugin that provides additional widgets and blocks for the Elementor page builder. The plugin fails to validate HTML tag names in the section headline feature, allowing contributors and higher-privileged users to inject malicious code that executes as JavaScript in the browser when content is viewed by other users, potentially compromising accounts or stealing sensitive data.

Quick answers

Is CVE-2026-86788 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86788 being exploited in the wild.
How severe is CVE-2026-86788?: Medium severity, with a CVSS score of 6.8, published 17 September 2026.
Which products and versions are affected?: HT Mega Addons for Elementor before 3.2.6.
Is there a fix for CVE-2026-86788?: A patch was published on 2026-09-15: Fixed in version 3.2.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86788 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86788?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the section headline rendering functionality of multiple widgets and blocks (CWE-79). The plugin does not restrict the HTML tag name to a safe allowlist, allowing authenticated users with contributor-level access and above to craft and store arbitrary tag names that execute JavaScript when the content is viewed. The attack is stored server-side, meaning it affects all users who view the compromised content, including site administrators and editors. No special preconditions beyond contributor access are required to exploit this vulnerability. The vulnerability affects versions 3.2.0 through 3.2.5, and a fix is available in version 3.2.6.

Affected products

HT Mega Addons for Elementor before 3.2.6

Timeline

2026-09-15: disclosed
2026-09-17: advisory
2026-09-15: patched: Fixed in version 3.2.6

References

https://wpscan.com/vulnerability/20cad1a6-944e-40f8-8fbc-d97cd1e5bb4b/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.