Cross-Site Scripting
22 records78.6%First: 2022. Latest: 2026.
Plugin security history
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 28 vulnerability records associated with Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits, published between 2022 and 2026.
Dataset last synchronized: 2026-08-03 00:31:25 UTC
At a glance
Security Snapshot
28Total records
0Critical
2High
26Medium
0Low
0Informational
28Patched records
0Currently marked unpatched
2022-02-21First disclosure
2026-06-05Latest disclosure
27 of 28CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2022 | 2 | |
| 2023 | 3 | |
| 2024 | 12 | |
| 2025 | 7 | |
| 2026 | 4 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| High | 2 | 7.1% |
| Medium | 26 | 92.9% |
Vulnerability-Type Breakdown
Missing Authorization
6 records21.4%First: 2022. Latest: 2025.
Patch Status
- Patched
- 28
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
3.1.12.1.42.1.22.1.02.0.9.12.0.8.32.0.7.32.0.7.22.0.6.82.0.6.52.0.6.32.0.6.22.0.5.62.0.6.12.0.6.02.0.5.72.0.42.0.5.4.12.0.31.8.5
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-3.1.0 | Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension) | June 5, 2026 | 3.1.1 | Medium |
*-2.0.7.2 | Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter | April 30, 2026 | 2.0.7.3 | Medium |
*-2.1.3 | Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits <= 2.1.3 - Authenticated (Author+) Stored Cross-Site Scripting | March 16, 2026 | 2.1.4 | Medium |
*-2.1.1 | Master Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text' | February 19, 2026 | 2.1.2 | Medium |
*-2.0.9.9.4 | Master Addons for Elementor <= 2.0.9.9.4 - Unauthenticated Insecure Direct Object Reference | December 31, 2025 | 2.1.0 | Medium |
*-2.0.9.9.3 | Master Addons for Elementor <= 2.0.9.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting | December 5, 2025 | 2.1.0 | Medium |
*-2.0.9.0 | Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox | August 11, 2025 | 2.0.9.1 | Medium |
*-2.0.8.2 | Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting | July 15, 2025 | 2.0.8.3 | Medium |
*-2.0.7.2 | Master Addons <= 2.0.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets | March 3, 2025 | 2.0.7.3 | Medium |
*-2.0.7.1 | Master Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter | March 3, 2025 | 2.0.7.2 | Medium |
*-2.0.6.7 | Master Addons -- Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip Module | January 6, 2025 | 2.0.6.8 | Medium |
*-2.0.9.9.4 | Master Addons for Elementor <= 2.0.9.9.4 - Authenticated (Author+) Stored Cross-Site Scripting | November 11, 2024 | 2.1.0 | Medium |
*-2.0.6.4 | Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-jltma-wrapper-link Element | September 9, 2024 | 2.0.6.5 | Medium |
*-2.0.6.2 | Master Addons for Elementor <= 2.0.6.2 - Authenticated (Author+) Stored Cross-Site Scripting | July 11, 2024 | 2.0.6.3 | Medium |
*-2.0.6.1 | Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to MA Template Creation or Modification | June 6, 2024 | 2.0.6.2 | Medium |
*-2.0.6.1 | Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Navigation Menu Widget | June 6, 2024 | 2.0.6.2 | High |
*-2.0.5.4.1 | Master Addons for Elementor <= 2.0.5.4.1 - Missing Authorization via get_jltma_save_menuitem_settings() | June 3, 2024 | 2.0.5.6 | Medium |
*-2.0.6.0 | Master Addons for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting | May 16, 2024 | 2.0.6.1 | Medium |
*-2.0.6.0 | Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting | May 15, 2024 | 2.0.6.1 | Medium |
*-2.0.5.9 | Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.5.9 - Contributor+ Stored Cross-Site Scripting | April 29, 2024 | 2.0.6.0 | Medium |
*-2.0.5.4.1 | Master Addons for Elementor <= 2.0.5.4.1 - Missing Authorization on Duplicate Post | April 25, 2024 | 2.0.5.6 | Medium |
*-2.0.5.6 | Master Addons for Elementor <= 2.0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget | March 26, 2024 | 2.0.5.7 | Medium |
*-2.0.5.4.1 | Master Addons for Elementor <= 2.0.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting | March 25, 2024 | 2.0.5.6 | Medium |
*-2.0.3 | Master Addons for Elementor <= 2.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting | October 11, 2023 | 2.0.4 | Medium |
*-2.0.5.3 | Master Addons for Elementor <= 2.0.5.3 - Missing Authorization | August 22, 2023 | 2.0.5.4.1 | High |
Selected source records
Latest Records
MediumCVE-2026-9281
Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension)
Published: June 5, 2026
- Affected versions
- *-3.1.0
- Patched versions
- 3.1.1
MediumCVE-2024-13362
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Published: April 30, 2026
- Affected versions
- *-3.4.12
- Patched versions
- 3.4.15
- Affected versions
- *-2.2.2
- Patched versions
- 2.2.5
- Affected versions
- *-3.0.5
- Patched versions
- 3.0.7
- Affected versions
- *-2.3.1
- Patched versions
- 2.3.2
- Affected versions
- *-2.0.2
- Patched versions
- 2.0.3
- Affected versions
- *-1.3.4
- Patched versions
- Not supplied
- Affected versions
- *-1.2.7
- Patched versions
- 1.2.8
- Affected versions
- *-1.3.1
- Patched versions
- 1.3.5
- Affected versions
- *-2.9.2
- Patched versions
- 2.10.0
- Affected versions
- *-2.6.7
- Patched versions
- 2.7.0
- Affected versions
- *-4.6.8
- Patched versions
- 4.7.6
- Affected versions
- *-1.9.2
- Patched versions
- 1.9.3
- Affected versions
- *-1.6.22
- Patched versions
- 1.6.23
- Affected versions
- *-1.4.2
- Patched versions
- 1.4.3
- Affected versions
- *-2.1
- Patched versions
- 2.2
- Affected versions
- *-2.6.5
- Patched versions
- 2.6.7
- Affected versions
- *-2.2.27
- Patched versions
- 2.5.1
- Affected versions
- *-3.2.6
- Patched versions
- 3.2.8
- Affected versions
- *-5.17.2
- Patched versions
- 5.19.0
- Affected versions
- *-1.1.16
- Patched versions
- 1.1.17
- Affected versions
- *-2.5.8
- Patched versions
- 2.6.1
- Affected versions
- *-1.1.3
- Patched versions
- 1.1.10
- Affected versions
- *-2.5.5
- Patched versions
- 2.5.6
- Affected versions
- *-4.2.0
- Patched versions
- 4.2.1
- Affected versions
- *-3.0.2
- Patched versions
- 3.0.3
- Affected versions
- *-1.5.5
- Patched versions
- 1.6
- Affected versions
- *-1.2.56
- Patched versions
- 1.2.57
- Affected versions
- *-3.2.4
- Patched versions
- 3.2.5
- Affected versions
- *-2.4.1
- Patched versions
- 2.4.4
- Affected versions
- *-1.4.0
- Patched versions
- 1.4.1
- Affected versions
- *-1.6.3
- Patched versions
- 1.6.4
- Affected versions
- *-1.5.140
- Patched versions
- 1.5.141
- Affected versions
- *-2.6.0
- Patched versions
- 2.6.1
- Affected versions
- *-2.3.4
- Patched versions
- 2.3.5
- Affected versions
- *-2.5.7
- Patched versions
- 2.5.9
- Affected versions
- *-3.2.6
- Patched versions
- 3.2.9
- Affected versions
- *-1.7
- Patched versions
- Not supplied
- Affected versions
- *-2.1.6
- Patched versions
- 2.2.0
- Affected versions
- *-1.5.10
- Patched versions
- 1.6.2
- Affected versions
- *-2.0.7.2
- Patched versions
- 2.0.7.3
- Affected versions
- *-2.4.27
- Patched versions
- 2.4.29
- Affected versions
- *-3.12.1
- Patched versions
- 3.13.1
- Affected versions
- *-6.0.2
- Patched versions
- Not supplied
- Affected versions
- *-5.222
- Patched versions
- 5.225
- Affected versions
- *-1.1.5
- Patched versions
- 1.1.6
- Affected versions
- *-1.9.0
- Patched versions
- 1.10.0
- Affected versions
- *-1.4.7
- Patched versions
- Not supplied
- Affected versions
- *-1.4.9
- Patched versions
- 1.5.0
- Affected versions
- *-3.5.1
- Patched versions
- 3.5.2
- Affected versions
- *-2.16.3.3
- Patched versions
- 2.16.3.6
- Affected versions
- *-1.7.2
- Patched versions
- 1.8.5
- Affected versions
- *-5.0.57
- Patched versions
- 5.1.8
- Affected versions
- *-1.8.99
- Patched versions
- 2.3.17
- Affected versions
- *-3.0.0
- Patched versions
- 3.1.0
- Affected versions
- *-3.4.9
- Patched versions
- 3.4.11
- Affected versions
- *-2.1.34
- Patched versions
- 2.1.35
- Affected versions
- *-1.1.13
- Patched versions
- 1.1.17
- Affected versions
- *-1.7
- Patched versions
- Not supplied
- Affected versions
- *-5.5.8
- Patched versions
- 5.5.9
- Affected versions
- *-1.9.4
- Patched versions
- 1.9.7
- Affected versions
- *-1.10.4
- Patched versions
- 1.10.5.1
- Affected versions
- *-6.1.13
- Patched versions
- 6.1.14
- Affected versions
- *-2.9.7
- Patched versions
- 2.10.0
- Affected versions
- *-2.2.38
- Patched versions
- 2.2.39
- Affected versions
- *-3.12
- Patched versions
- 3.13
- Affected versions
- *-2.2.0
- Patched versions
- 2.3.1
- Affected versions
- *-2.3.7
- Patched versions
- 2.3.12
- Affected versions
- *-3.2.8
- Patched versions
- 3.2.9
- Affected versions
- *-2.3.0
- Patched versions
- 2.3.1
- Affected versions
- *-2.6.0
- Patched versions
- 2.10.0
- Affected versions
- *-2.07
- Patched versions
- 2.08
- Affected versions
- *-6.6.5
- Patched versions
- 6.6.6
- Affected versions
- *-3.9.6
- Patched versions
- 3.9.7
- Affected versions
- *-2.0.82
- Patched versions
- 2.0.83
- Affected versions
- *-3.3.2
- Patched versions
- 3.3.4
- Affected versions
- *-3.2.7
- Patched versions
- 3.2.9
- Affected versions
- *-3.2.4.4
- Patched versions
- 3.2.4.5
- Affected versions
- *-2.1.0
- Patched versions
- 2.2.0
- Affected versions
- *-1.7.0
- Patched versions
- 1.7.1
- Affected versions
- *-1.7.0
- Patched versions
- 1.7.1
- Affected versions
- *-2.5.9
- Patched versions
- 2.5.17
- Affected versions
- *-2.8.6
- Patched versions
- 2.8.7
- Affected versions
- *-1.6.3.2
- Patched versions
- 1.6.3.3
- Affected versions
- *-7.3.3
- Patched versions
- 7.3.4
- Affected versions
- *-1.0.40
- Patched versions
- 1.0.41
- Affected versions
- *-1.10.6
- Patched versions
- 1.10.8
- Affected versions
- *-2.4.2
- Patched versions
- 2.4.4
- Affected versions
- *-3.3.0
- Patched versions
- 3.3.2
- Affected versions
- *-3.3.7
- Patched versions
- 3.3.8
- Affected versions
- *-2.25.16
- Patched versions
- 2.25.19
- Affected versions
- *-2.0.0
- Patched versions
- 2.0.1
- Affected versions
- *-1.13.15
- Patched versions
- 1.13.16
- Affected versions
- *-1.6.0
- Patched versions
- 1.6.1
- Affected versions
- *-3.0.6
- Patched versions
- 3.0.7
- Affected versions
- *-3.2.2
- Patched versions
- 3.2.3
- Affected versions
- *-1.5.8
- Patched versions
- Not supplied
- Affected versions
- *-5.3.4
- Patched versions
- 5.4.0
- Affected versions
- *-3.8.3
- Patched versions
- 3.8.4
- Affected versions
- *-1.2.7
- Patched versions
- 1.2.9
- Affected versions
- *-2.7.33
- Patched versions
- 2.7.34
- Affected versions
- *-5.5.31
- Patched versions
- 5.5.32
- Affected versions
- *-2.5.9
- Patched versions
- 2.6.0
- Affected versions
- *-2.4.1
- Patched versions
- 2.4.3
- Affected versions
- *-4.4.1
- Patched versions
- 4.4.2
- Affected versions
- *-1.8.5
- Patched versions
- 1.9
- Affected versions
- *-1.16.3
- Patched versions
- 1.16.4
- Affected versions
- *-1.3.3
- Patched versions
- 1.3.4
- Affected versions
- *-2.3.11
- Patched versions
- Not supplied
- Affected versions
- *-1.8.4.8.1
- Patched versions
- 1.8.4.9.1
- Affected versions
- *-3.1.28
- Patched versions
- 3.2.2
- Affected versions
- *-8.0.7
- Patched versions
- 8.0.8
- Affected versions
- *-2.1.5
- Patched versions
- Not supplied
- Affected versions
- *-1.6.0
- Patched versions
- 1.6.5
- Affected versions
- *-1.9.8
- Patched versions
- 2.0.19
- Affected versions
- *-1.2.6
- Patched versions
- Not supplied
- Affected versions
- *-4.5.0
- Patched versions
- 4.5.1
- Affected versions
- *-1.0.4
- Patched versions
- 1.1
- Affected versions
- *-1.7.34
- Patched versions
- 1.8.12
- Affected versions
- *-6.1.10
- Patched versions
- 6.1.11
- Affected versions
- *-2.8.4
- Patched versions
- Not supplied
- Affected versions
- *-3.1.26
- Patched versions
- 3.1.28
- Affected versions
- *-3.12.0
- Patched versions
- 3.16.0
- Affected versions
- *-2.24.6
- Patched versions
- 2.25.2
- Affected versions
- *-7.7.0
- Patched versions
- 7.7.3
- Affected versions
- *-2.7.0
- Patched versions
- 2.7.7
- Affected versions
- *-3.7.3
- Patched versions
- Not supplied
- Affected versions
- *-3.2.7
- Patched versions
- 3.2.9
- Affected versions
- *-1.6.3
- Patched versions
- 1.6.6
- Affected versions
- *-1.9.0
- Patched versions
- 1.21.0
- Affected versions
- *-1.6.6
- Patched versions
- 1.7.5
- Affected versions
- *-1.5.8
- Patched versions
- 1.6.1
MediumCVE-2026-32462
Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits <= 2.1.3 - Authenticated (Author+) Stored Cross-Site Scripting
Published: March 16, 2026
- Affected versions
- *-2.1.3
- Patched versions
- 2.1.4
MediumCVE-2026-2486
Master Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text'
Published: February 19, 2026
- Affected versions
- *-2.1.1
- Patched versions
- 2.1.2
MediumCVE-2025-63053
Master Addons for Elementor <= 2.0.9.9.4 - Unauthenticated Insecure Direct Object Reference
Published: December 31, 2025
- Affected versions
- *-2.0.9.9.4
- Patched versions
- 2.1.0
MediumCVE-2025-63055
Master Addons for Elementor <= 2.0.9.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: December 5, 2025
- Affected versions
- *-2.0.9.9.3
- Patched versions
- 2.1.0
MediumCVE-2025-8874
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox
Published: August 11, 2025
- Affected versions
- *-2.0.9.0
- Patched versions
- 2.0.9.1
MediumCVE-2025-5284
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: July 15, 2025
- Affected versions
- *-2.0.8.2
- Patched versions
- 2.0.8.3
Highest-Severity Records
HighCVE-2023-40679
Master Addons for Elementor <= 2.0.5.3 - Missing Authorization
Published: August 22, 2023
- Affected versions
- *-2.0.5.3
- Patched versions
- 2.0.5.4.1
HighCVE-2024-5542
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Navigation Menu Widget
Published: June 6, 2024
- Affected versions
- *-2.0.6.1
- Patched versions
- 2.0.6.2
MediumCVE-2024-5382
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to MA Template Creation or Modification
Published: June 6, 2024
- Affected versions
- *-2.0.6.1
- Patched versions
- 2.0.6.2
MediumCVE-2025-5284
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: July 15, 2025
- Affected versions
- *-2.0.8.2
- Patched versions
- 2.0.8.3
MediumCVE-2025-8874
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox
Published: August 11, 2025
- Affected versions
- *-2.0.9.0
- Patched versions
- 2.0.9.1
MediumCVE-2024-9502
Master Addons -- Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip Module
Published: January 6, 2025
- Affected versions
- *-2.0.6.7
- Patched versions
- 2.0.6.8
MediumCVE-2026-9281
Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension)
Published: June 5, 2026
- Affected versions
- *-3.1.0
- Patched versions
- 3.1.1
MediumCVE-2024-3134
Master Addons for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: May 16, 2024
- Affected versions
- *-2.0.6.0
- Patched versions
- 2.0.6.1
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.