CVE-2026-4106mediumobserved exploitationCWE-200

CVE-2026-4106: medium-severity vulnerability in HT Mega Addons for Elementor

HT Mega < 3.0.7 – Unauthenticated PII Disclosure

Published

Follow this CVE+ Monitor HT Mega Addons for Elementor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 5.3epss 0.7%
from disclosure to weaponsame day
Published on NVDApr 23
1st PoCApr 12
VulnCheck+173d
The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some PII (such as full name, city, state and country) of customers who placed orders in the last 7 days
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · HT Mega Addons for Elementor
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — HT Mega Addons for Elementor

In the same product, most dangerous first.

CVE-2026-86788MEDIUMHT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline TagEPSS 0.4%