Threat Entry Updated 2026-04-15

CVE-2026-2486 - Master Addons For Elementor Plugin

The Master Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ma_el_bh_table_btn_text' parameter in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Master Addons For Elementor

CVE-2026-2486

MEDIUM CVSS 6.4 2026-02-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-28

CVE-2024-2139 - Master Addons For Elementor Plugin

The Master Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Table widget in all versions up to, and including, 2.0.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Master Addons For Elementor

CVE-2024-2139

MEDIUM CVSS 6.4 2024-03-27

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2022-0327 - Master Addons For Elementor Plugin

The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX action, available to unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting

PLUGIN Master Addons For Elementor

CVE-2022-0327

MEDIUM CVSS 6.1 2022-03-14

Risk Score

Open Full Technical Breakdown