CVE Daily

CVE-2025-8151

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable t...

Medium CVSS 4.3

Overview

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 via the 'save_block_css' function. This makes it possible for authenticated attackers, with Author-level access and above, to create CSS files in any directory, and delete CSS files in any directory in a Windows environment.

CWE: CWE-22 Published: 2025-07-31T12:15:26.820
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 4.3 (MEDIUM)
  • Detected tags: path, wordpress (tag impact: MODERATE)

Recommended actions:

  • Canonicalize path; block `..` traversal; use allowlists.

Recommended tools

Tags