What is the CVSS score of EUVD-2026-34940?

EUVD-2026-34940 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Master Addons for Elementor EUVD-2026-34940

| CVE-2026-9281 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-06 Wordfence

GHSA-75j2-rqrx-9c7f

PHP XSS WordPress Master Addons For Elementor Widgets Extensions Theme Builder Popup Builder Template Kits

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 02:28 vuln.today

CVE Published

Jun 06, 2026 - 01:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Master Addons For Elementor - Widgets, Extensions, Theme Builder, Popup Builder & Template Kits plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension) in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unfiltered_html capability check is only enforced during Elementor control registration (UI rendering) and not during the save process, enabling Author-level users to inject the jtlma_custom_js setting directly via a crafted POST request to admin-ajax.php?action=elementor_ajax, bypassing the UI-level restriction entirely.

AnalysisAI

Stored Cross-Site Scripting in the Master Addons for Elementor WordPress plugin (versions up to and including 3.1.0) allows authenticated attackers with author-level access to inject persistent JavaScript into pages by exploiting a broken authorization boundary in the Custom JS Extension. The flaw arises because the unfiltered_html capability check is enforced only during UI rendering (Elementor control registration) and entirely absent from the save handler, permitting a crafted POST to admin-ajax.php?action=elementor_ajax to store arbitrary scripts that execute in every subsequent visitor's browser. No public exploit or CISA KEV listing has been identified at time of analysis, though the Wordfence disclosure and direct source-code references confirm the issue is well-documented.

Technical ContextAI

The affected component is the Custom JS Extension within the Master Addons for Elementor plugin (vendor: litonice13, CPE: cpe:2.3:a:litonice13:master_addons_for_elementor_-_widgets,_extensions,_theme_builder,_popup_builder_&_template_kits:*). The plugin exposes a 'jtlma_custom_js' page setting processed in custom-js.php. WordPress best practice requires that raw JavaScript injection be gated behind the unfiltered_html capability (restricted to Editors and above by default). Here, that gate exists only in the Elementor UI registration path (lines L80, L206, L214 of custom-js.php in tags/3.1.0 and 3.0.2), but the save handler that processes the admin-ajax.php Elementor AJAX endpoint lacks the equivalent check. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class - user-supplied script content reaches persistent storage without sanitization and is later output without escaping, resulting in classic stored XSS with changed scope (S:C in CVSS) because the injected payload affects browser sessions belonging to other users, not just the attacker's own session.

RemediationAI

An upstream fix has been committed to the plugin repository, as evidenced by the referenced changeset (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3556818%40master-addons&new=3556818%40master-addons); however, the exact patched release version number is not independently confirmed from the available intelligence - administrators should update to the latest available version beyond 3.1.0 from the WordPress plugin repository and verify the changelog references this fix. As a compensating control on sites where an immediate update is not possible, restrict the WordPress author role so that no untrusted users hold author-level access or above; this directly removes the attacker's required privilege level. Alternatively, disabling the Custom JS Extension feature within the Master Addons plugin settings eliminates the vulnerable save handler entirely, though this removes custom JavaScript functionality for page builders. Web Application Firewall rules targeting admin-ajax.php POST bodies containing script tags or the jtlma_custom_js parameter can reduce exploitation surface but should not be treated as a primary defense given encoding evasion possibilities. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5b8e052a-6e60-4455-96c9-b2a3e86773da for additional guidance.