What the vulnerability does
01Description
The Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension) in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unfiltered_html capability check is only enforced during Elementor control registration (UI rendering) and not during the save process, enabling Author-level users to inject the jtlma_custom_js setting directly via a crafted POST request to admin-ajax.php?action=elementor_ajax, bypassing the UI-level restriction entirely.
Explanation of Vulnerability in Simple Terms
02Summary
Master Addons For Elementor contains a cross-site scripting (XSS) vulnerability in versions up to 3.1.0. An authenticated user with low privileges can inject malicious scripts that execute in other users' browsers, potentially affecting site-wide functionality. The vulnerability requires network access but no user interaction from the victim. Update to a version newer than 3.1.0 to remediate.
What an attacker can do
03Attacker Capabilities
Inject and execute malicious JavaScript in other users' browsers, potentially stealing data or performing actions on their behalf.
Potential impact on your site
04Site Impact
Authenticated users can inject scripts affecting other visitors and administrators; site-wide XSS exposure if not patched.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account on the site (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
June 6, 2026
CVE published
June 6, 2026
Record updated
