Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Vulnerabilities

• CVE-2024-35660unauthenticated≤ 2.0.5.4.1

  WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on API vulnerability

  Critical 9.8

• CVE-2026-3132subscriber+≤ 2.1.3

  Master Addons for Elementor Premium <= 2.1.3 - Authenticated (Subscriber+) Remote Code Execution via render_preview

  High 8.8

• CVE-2024-33595login required≤ 2.0.5.4.1

  WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on Duplicate Post vulnerability

  High 8.8

• CVE-2026-85410contributor+≤ 3.2.2

  Master Addons for Elementor <= 3.2.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter

  High 8.1

• CVE-2026-75921editor+≤ 3.1.9

  Master Addons for Elementor <= 3.1.9 - Incorrect Authorization to Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extraction

  High 7.2

• CVE-2026-62089login required≤ 3.2.2

  WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability

  High 7.1

• CVE-2023-40679unauthenticated≤ 2.0.5.3

  WordPress Master Elementor Addons plugin <= 2.0.5.3 - Broken Access Control vulnerability

  Medium 6.5

• CVE-2025-63055login required≤ 2.0.9.9.4

  WordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Cross Site Scripting (XSS) vulnerability

  Medium 6.5

• CVE-2026-9281author+≤ 3.1.0

  Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension)

  Medium 6.4

• CVE-2026-2486contributor+≤ 2.1.1

  Master Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text'

  Medium 6.4

• CVE-2025-8874contributor+≤ 2.0.9.0

  Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-

  Medium 6.4

• CVE-2025-5284contributor+≤ 2.0.8.2

  Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-

  Medium 6.4

• CVE-2024-5542unauthenticated≤ 2.0.6.1

  Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to Unauthenticated Stored Cross-Sit

  Medium 6.1

• CVE-2026-32462high privilege≤ 2.1.3

  WordPress Master Addons for Elementor plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability

  Medium 5.9

• CVE-2024-52387high privilege≤ 2.0.9.9.4

  WordPress Master Addons plugin <= 2.0.9.9.4 - Cross Site Scripting (XSS) vulnerability

  Medium 5.9

• CVE-2024-35702login required≤ 2.0.6.0

  WordPress Master Addons for Elementor plugin <= 2.0.6.0 - Cross Site Scripting (XSS) vulnerability

  Medium 5.4

• CVE-2024-35688login required≤ 2.0.5.9

  WordPress Master Addons for Elementor plugin <= 2.0.5.9 - Cross Site Scripting (XSS) vulnerability

  Medium 5.4

• CVE-2024-29911login required≤ 2.0.5.4.1

  WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Cross Site Scripting (XSS) vulnerability

  Medium 5.4

• CVE-2025-0433contributor+≤ 2.0.7.1

  Master Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

  Medium 5.4

• CVE-2024-9618contributor+≤ 2.0.7.2

  Master Addons <= 2.0.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

  Medium 5.4

• CVE-2024-9502contributor+≤ 2.0.6.7

  Master Addons -- Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Medium 5.4

• CVE-2024-6282contributor+≤ 2.0.6.4

  Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Medium 5.4

• CVE-2024-3134contributor+≤ 2.0.6.0

  Master Addons for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Medium 5.4

• CVE-2024-4580contributor+≤ 2.0.6.0

  Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Medium 5.4

• CVE-2024-4265contributor+≤ 2.0.5.9

  Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.5.9 - Contributor+ Stored Cross-Site Scripting

  Medium 5.4

• CVE-2024-2139contributor+≤ 2.0.5.6

  Master Addons for Elementor <= 2.0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget

  Medium 5.4

• CVE-2025-63053unauthenticated≤ 2.0.9.9.4

  WordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Insecure Direct Object References (IDOR) vulnerability

  Medium 5.3

• CVE-2024-5382unauthenticated≤ 2.0.6.1

  Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to MA Template Creation or Modifica

  Medium 5.3

• CVE-2024-38710high privilege≤ 2.0.6.2

  WordPress Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin <= 2.0.6.2 - Cross Site Scripting (XSS) vulnerability

  Medium 4.8