WordPress security by component

Master Addons for Elementor

Plugin description

Master Addons for Elementor adds Elementor widgets, templates, extensions, and design elements for creating customized WordPress pages and layouts.

Master Addons for Elementor (master-addons) is a WordPress plugin with 29 published CVE records in this archive. The latest tracked vulnerability was published Sep 18, 2026; the highest published CVSS base score is 8.8.

Plugin slug: master-addons

Latest vulnerability

CVE-2026-85410: Master Addons popup identifiers permit Contributor-level deletion of arbitrary posts

Master Addons for Elementor through 3.2.2 allows an authenticated Contributor or higher role to supply an attacker-selected popup_id and modify the title or metadata of arbitrary WordPress posts, or permanently delete them. The required nonce is exposed on the edit-jltma_popup administration screen, which Contributors can access because the jltma_popup post type uses capability_type='post'. Possession of that nonce therefore does not establish permission to modify or delete the selected object. The export does not disclose the full mutation endpoint or handler name. This is a content-integrity and availability issue, not an established administrator-account takeover.

PublishedSep 18, 2026

Safe version guidanceSee mitigation notes

Published vulnerabilities for master-addons
		Safe version
Sep 18, 2026	CVE-2026-85410 Master Addons popup identifiers permit Contributor-level deletion of arbitrary posts Master Addons for Elementor through 3.2.2 allows an authenticated Contributor or higher role to supply an attacker-selected popup_id and modify the title or metadata of arbitrary WordPress posts, or permanently delete them. The required nonce is exposed on the edit-jltma_popup administration screen, which Contributors can access because the jltma_popup post type uses capability_type='post'. Possession of that nonce therefore does not establish permission to modify or delete the selected object. The export does not disclose the full mutation endpoint or handler name. This is a content-integrity and availability issue, not an established administrator-account takeover.	See mitigation notes	CVE8.1
Sep 17, 2026	CVE-2026-91015 Master Addons lets public visitors disable Popup Builder popups Master Addons for Elementor from 3.0.0 up to but not including 3.1.9, the AJAX action that deactivates Popup Builder popups checks only a nonce that is exposed to every visitor. Without a capability check, an unauthenticated attacker can use that nonce to permanently disable any popup. The export does not name the AJAX action, popup-ID field or handler.	3.1.9	CVE5.3
Sep 11, 2026	CVE-2026-62089 Master Addons for Elementor permits low-privilege abuse Master Addons for Elementor through 3.2.2 has a missing-authorization flaw that permits privilege abuse by a low-privilege authenticated user. The CNA vector requires no user interaction and rates availability impact as high and integrity impact as low. The authoritative export does not identify the minimum WordPress role, endpoint, action, parameter, protected operation, or resulting privilege.	3.2.3	CVE7.1
Sep 01, 2026	CVE-2026-75921 Master Addons permits Editor-level arbitrary file upload Master Addons through 3.1.9 protects its upload_template_kit() AJAX handler with upload_files rather than manage_options. Editors can obtain the localized nonce from the Pages list, submit a template-kit ZIP, and exploit the lack of per-entry file-type filtering after extraction to place potentially executable files on the server.	See mitigation notes	CVE7.2
Jun 06, 2026	CVE-2026-9281 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits: Cross-site scripting Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits is affected by cross-site scripting. Exploitation requires an authenticated author account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 3.1.0.	3.1.1	CVE6.4
Mar 13, 2026	CVE-2026-32462 Master Addons for Elementor: Cross-site scripting Master Addons for Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9
Mar 02, 2026	CVE-2026-3132 Master Addons for Elementor Premium: Code execution Master Addons for Elementor Premium is affected by code execution. Exploitation requires an authenticated subscriber account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE8.8
Feb 20, 2026	CVE-2024-52387 Master Addons for Elementor: Cross-site scripting Master Addons for Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9
Dec 31, 2025	CVE-2025-63053 Master Addons for Elementor: A security weakness Master Addons for Elementor is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3
Dec 24, 2025	CVE-2023-40679 Master Addons for Elementor: A security weakness Master Addons for Elementor is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5
Dec 09, 2025	CVE-2025-63055 Master Addons for Elementor: Cross-site scripting Master Addons for Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5
Aug 12, 2025	CVE-2025-8874 Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Cross-site scripting Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Jul 16, 2025	CVE-2025-5284 Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Cross-site scripting Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Mar 04, 2025	CVE-2025-0433 Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Cross-site scripting Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Mar 04, 2025	CVE-2024-9618 Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Cross-site scripting Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Jan 07, 2025	CVE-2024-9502 Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Cross-site scripting Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Sep 10, 2024	CVE-2024-6282 Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Cross-site scripting Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.4
Jul 20, 2024	CVE-2024-38710 Master Addons for Elementor: Cross-site scripting Master Addons for Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9
Jun 09, 2024	CVE-2024-35660 Master Addons for Elementor: A security weakness Master Addons for Elementor is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5
Jun 08, 2024	CVE-2024-35702 Master Addons for Elementor: Cross-site scripting Master Addons for Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5
Jun 08, 2024	CVE-2024-35688 Master Addons for Elementor: Cross-site scripting Master Addons for Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5
Jun 07, 2024	CVE-2024-5542 Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Cross-site scripting Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.2
Jun 07, 2024	CVE-2024-5382 Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: A security weakness Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5
May 16, 2024	CVE-2024-3134 Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Cross-site scripting Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
May 16, 2024	CVE-2024-4580 Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Cross-site scripting Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
May 02, 2024	CVE-2024-4265 Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Cross-site scripting Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Apr 29, 2024	CVE-2024-33595 Master Addons for Elementor: A security weakness Master Addons for Elementor is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Mar 27, 2024	CVE-2024-29911 Master Addons for Elementor: Cross-site scripting Master Addons for Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5
Mar 27, 2024	CVE-2024-2139 Master Addons for Elementor: Cross-site scripting Master Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers