PT-2026-47125 · Litonice13 · Master Addons For Elementor – Widgets

Athiwat Tiprasaharn

+2

·

Published

2026-06-06

·

Updated

2026-06-06

·

CVE-2026-9281

CVSS v3.1

6.4

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
The Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jtlma custom js' Page Setting (Custom JS Extension) in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unfiltered html capability check is only enforced during Elementor control registration (UI rendering) and not during the save process, enabling Author-level users to inject the jtlma custom js setting directly via a crafted POST request to admin-ajax.php?action=elementor ajax, bypassing the UI-level restriction entirely.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-9281

Affected Products

Master Addons For Elementor – Widgets