What is the CVSS score of CVE-2026-32462?

CVE-2026-32462 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Master Addons for Elementor CVE-2026-32462

EUVD-2026-12023 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-13 Patchstack

WordPress XSS Wordpress Plugin Master Addons For Elementor

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

4.8 MEDIUM

High-privilege content injection (PR:H) and victim page visit (UI:R) are prerequisites; scope changes to victim browser (S:C); XSS yields no availability impact so A:N is appropriate.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 22, 2026 - 21:37 NVD

5.9 (MEDIUM)

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-12023

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons allows DOM-Based XSS.This issue affects Master Addons for Elementor: from n/a through <= 2.1.3.

AnalysisAI

DOM-Based Cross-Site Scripting in Master Addons for Elementor (WordPress plugin, versions through 2.1.3) enables high-privileged attackers to inject malicious scripts that execute within victims' browsers via the DOM. The scope change (S:C) in the CVSS vector confirms impact extends beyond the injecting user to any visitor of the compromised page. No public exploit code or CISA KEV listing has been identified; EPSS sits at 0.03% (8th percentile), placing real-world exploitation probability extremely low at time of analysis.

Technical ContextAI

Master Addons for Elementor is a WordPress plugin (CPE: cpe:2.3:a:liton_arefin:master_addons_for_elementor:*:*:*:*:*:*:*:*) that extends the Elementor page builder with additional widgets and elements. CWE-79 (Improper Neutralization of Input During Web Page Generation) manifests here as DOM-Based XSS, meaning unsanitized input from an authenticated user is written directly into the browser's Document Object Model at runtime - bypassing server-side output encoding entirely. Unlike reflected XSS, DOM-based variants do not necessarily touch the server response body, making them harder to detect with server-side WAF rules. The Elementor ecosystem's reliance on JavaScript-heavy widget rendering makes it a recurring surface for this class of vulnerability.

RemediationAI

Update Master Addons for Elementor to a version released after 2.1.3 - the exact patched release should be confirmed via the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/master-addons/vulnerability/wordpress-master-addons-for-elementor-plugin-2-1-3-cross-site-scripting-xss-vulnerability, as the available data does not specify an explicit fixed version number. If an immediate upgrade is not feasible, restrict Elementor editor access exclusively to fully trusted administrator accounts and avoid granting the Editor role to any untrusted party, which directly eliminates the PR:H attack path. Additionally, deploying a WAF rule to detect DOM-based XSS patterns in Elementor widget parameters can serve as a compensating control, though DOM-based payloads may partially evade server-side inspection. Audit existing Elementor pages for unexpected script content as a detection measure.