Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Уязвимости

• CVE-2024-35660без авторизации≤ 2.0.5.4.1

  WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on API vulnerability

  Критич. 9.8

• CVE-2026-3132подписчик+≤ 2.1.3

  Master Addons for Elementor Premium <= 2.1.3 - Authenticated (Subscriber+) Remote Code Execution via render_preview

  Высокий 8.8

• CVE-2024-33595нужен вход≤ 2.0.5.4.1

  WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on Duplicate Post vulnerability

  Высокий 8.8

• CVE-2026-85410участник+≤ 3.2.2

  Master Addons for Elementor <= 3.2.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter

  Высокий 8.1

• CVE-2026-75921редактор+≤ 3.1.9

  Master Addons for Elementor <= 3.1.9 - Incorrect Authorization to Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extraction

  Высокий 7.2

• CVE-2026-62089нужен вход≤ 3.2.2

  WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability

  Высокий 7.1

• CVE-2023-40679без авторизации≤ 2.0.5.3

  WordPress Master Elementor Addons plugin <= 2.0.5.3 - Broken Access Control vulnerability

  Средний 6.5

• CVE-2025-63055нужен вход≤ 2.0.9.9.4

  WordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Cross Site Scripting (XSS) vulnerability

  Средний 6.5

• CVE-2026-9281автор+≤ 3.1.0

  Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension)

  Средний 6.4

• CVE-2026-2486участник+≤ 2.1.1

  Master Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text'

  Средний 6.4

• CVE-2025-8874участник+≤ 2.0.9.0

  Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-

  Средний 6.4

• CVE-2025-5284участник+≤ 2.0.8.2

  Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-

  Средний 6.4

• CVE-2024-5542без авторизации≤ 2.0.6.1

  Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to Unauthenticated Stored Cross-Sit

  Средний 6.1

• CVE-2026-32462высокие права≤ 2.1.3

  WordPress Master Addons for Elementor plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability

  Средний 5.9

• CVE-2024-52387высокие права≤ 2.0.9.9.4

  WordPress Master Addons plugin <= 2.0.9.9.4 - Cross Site Scripting (XSS) vulnerability

  Средний 5.9

• CVE-2024-35702нужен вход≤ 2.0.6.0

  WordPress Master Addons for Elementor plugin <= 2.0.6.0 - Cross Site Scripting (XSS) vulnerability

  Средний 5.4

• CVE-2024-35688нужен вход≤ 2.0.5.9

  WordPress Master Addons for Elementor plugin <= 2.0.5.9 - Cross Site Scripting (XSS) vulnerability

  Средний 5.4

• CVE-2024-29911нужен вход≤ 2.0.5.4.1

  WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Cross Site Scripting (XSS) vulnerability

  Средний 5.4

• CVE-2025-0433участник+≤ 2.0.7.1

  Master Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

  Средний 5.4

• CVE-2024-9618участник+≤ 2.0.7.2

  Master Addons <= 2.0.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

  Средний 5.4

• CVE-2024-9502участник+≤ 2.0.6.7

  Master Addons -- Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Средний 5.4

• CVE-2024-6282участник+≤ 2.0.6.4

  Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Средний 5.4

• CVE-2024-3134участник+≤ 2.0.6.0

  Master Addons for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Средний 5.4

• CVE-2024-4580участник+≤ 2.0.6.0

  Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Средний 5.4

• CVE-2024-4265участник+≤ 2.0.5.9

  Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.5.9 - Contributor+ Stored Cross-Site Scripting

  Средний 5.4

• CVE-2024-2139участник+≤ 2.0.5.6

  Master Addons for Elementor <= 2.0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget

  Средний 5.4

• CVE-2025-63053без авторизации≤ 2.0.9.9.4

  WordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Insecure Direct Object References (IDOR) vulnerability

  Средний 5.3

• CVE-2024-5382без авторизации≤ 2.0.6.1

  Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to MA Template Creation or Modifica

  Средний 5.3

• CVE-2024-38710высокие права≤ 2.0.6.2

  WordPress Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin <= 2.0.6.2 - Cross Site Scripting (XSS) vulnerability

  Средний 4.8