Master Addons For Elementor
Monthly
Missing authorization in the Master Addons for Elementor WordPress plugin (≤3.2.2) by Pixar Labs enables privilege abuse by authenticated low-privileged users. The CVSS vector (PR:L/C:N/I:L/A:H) indicates that a subscriber-level or similarly low-privileged WordPress account is sufficient to trigger operations with high availability impact - likely destructive actions such as resetting plugin settings, deleting content blocks, or disrupting site functionality - while retaining limited integrity modification capability. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
DOM-Based Cross-Site Scripting in Master Addons for Elementor (WordPress plugin, versions through 2.1.3) enables high-privileged attackers to inject malicious scripts that execute within victims' browsers via the DOM. The scope change (S:C) in the CVSS vector confirms impact extends beyond the injecting user to any visitor of the compromised page. No public exploit code or CISA KEV listing has been identified; EPSS sits at 0.03% (8th percentile), placing real-world exploitation probability extremely low at time of analysis.
The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Missing authorization in the Master Addons for Elementor WordPress plugin (≤3.2.2) by Pixar Labs enables privilege abuse by authenticated low-privileged users. The CVSS vector (PR:L/C:N/I:L/A:H) indicates that a subscriber-level or similarly low-privileged WordPress account is sufficient to trigger operations with high availability impact - likely destructive actions such as resetting plugin settings, deleting content blocks, or disrupting site functionality - while retaining limited integrity modification capability. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
DOM-Based Cross-Site Scripting in Master Addons for Elementor (WordPress plugin, versions through 2.1.3) enables high-privileged attackers to inject malicious scripts that execute within victims' browsers via the DOM. The scope change (S:C) in the CVSS vector confirms impact extends beyond the injecting user to any visitor of the compromised page. No public exploit code or CISA KEV listing has been identified; EPSS sits at 0.03% (8th percentile), placing real-world exploitation probability extremely low at time of analysis.
The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.