CVE-2026-9281: Master Addons For Elementor Stored XSS Vulnerability (3.1.0 and Earlier)

Technical summary

The vulnerability resides in the handling of the 'jtlma_custom_js' page setting within the Master Addons For Elementor plugin's Custom JS Extension. The plugin enforces an 'unfiltered_html' capability check only during Elementor control registration (UI rendering phase), not during the actual save operation via admin-ajax.php. This allows authenticated users with author-level access or higher to bypass the UI-level restriction by crafting a POST request directly to the admin-ajax.php endpoint with action=elementor_ajax, injecting arbitrary JavaScript that gets stored in the database without sanitization or escaping. The stored payload executes in the context of any user visiting the affected page, resulting in a stored XSS condition. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

A successful exploitation could compromise website integrity and user security. Attackers with author-level access (a common privilege level for content creators, editors, or compromised accounts) could inject malicious scripts that harvest visitor credentials, exfiltrate data, perform unauthorized actions on behalf of visitors, or redirect users to malware distribution sites. For organizations running Master Addons on client-facing WordPress sites, this represents a direct threat to visitor trust and data confidentiality. The impact extends beyond the immediate website to any user who visits an injected page, making the blast radius potentially significant for high-traffic sites.

Affected systems

Master Addons For Elementor plugin versions 3.1.0 and earlier are vulnerable. This includes organizations using any version of the plugin with WordPress sites that grant author-level access to contributors, editors, or other non-administrative users. The vulnerability does not require admin-level privileges to exploit, making it accessible to a broader set of potential attackers, including disgruntled staff or compromised lower-privilege accounts.

Exploitability

The vulnerability is moderately exploitable. It requires prior authentication (author-level access or higher) and the attacker must have knowledge of the WordPress admin-ajax.php endpoint and the specific parameter structure. However, once the attacker has author-level credentials—whether through social engineering, credential stuffing, or insider threat—the exploitation itself is straightforward: a single crafted POST request can inject persistent malicious code. No user interaction is required to execute the payload; any visitor to the affected page triggers script execution. The CVSS 3.1 score of 6.4 (Medium severity) reflects the requirement for authenticated access balanced against the network-accessible nature and the ability to affect multiple users.

Remediation

Organizations using Master Addons For Elementor should immediately update to a patched version above 3.1.0 once available. Until patching is possible, restrict author-level access to only trusted users, regularly audit user permissions, and monitor admin-ajax.php logs for suspicious activity. Consider disabling the Custom JS Extension feature at the plugin level if not actively used. Additionally, implement Web Application Firewall (WAF) rules to detect and block POST requests to admin-ajax.php that contain suspicious JavaScript patterns in the jtlma_custom_js parameter.

Patch guidance

The vendor should release a patched version that enforces input sanitization and output escaping on the 'jtlma_custom_js' setting during the save process, not just during UI registration. The fix must apply the 'unfiltered_html' capability check at the point of data persistence, not just at the UI layer. Organizations should verify patch availability through the official Master Addons for Elementor plugin page on WordPress.org and apply updates immediately after testing in a staging environment to ensure compatibility with custom configurations.

Detection guidance

Monitor WordPress audit logs and database activity for modifications to the jtlma_custom_js setting. Look for POST requests to admin-ajax.php with action=elementor_ajax containing JavaScript code fragments, especially from author-level accounts during unusual hours. Use WordPress security plugins that log option changes and conduct periodic page inspections for unexpected inline JavaScript. If using a SIEM, create rules to flag admin-ajax.php requests that include script tags or event handlers in POST parameters. Check the wp_options table directly for entries containing 'jtlma_custom_js' with suspicious content.

Why prioritize this

This vulnerability should be prioritized due to the combination of persistence (stored XSS), broad impact (affects all site visitors), and low barrier to exploitation (requires only author-level access, which is common in multi-user WordPress environments). While not yet in the CISA Known Exploited Vulnerabilities catalog, the relative ease of exploitation and the widespread use of Elementor and its extensions in WordPress ecosystems make this a near-term risk. Organizations should patch before the vulnerability becomes widely publicized or active exploitation emerges.

Risk score, explained

The CVSS 3.1 score of 6.4 (Medium) reflects a network-accessible vulnerability requiring low-privilege authentication, with confidentiality and integrity impact but no availability impact. The score does not capture the full business risk: stored XSS affecting multiple users and persistent access to a site's trust layer warrant treating this as a high-priority patch candidate, especially for public-facing or sensitive websites. The 'Medium' classification is driven by the authentication requirement; however, organizations should not be falsely reassured—author-level access is frequently granted and often compromised.

Frequently asked questions