What’s Vulnerable › Products
litonice13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits vulnerabilities
23 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.
Latest litonice13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits vulnerabilities
- CVE-2026-9281 — Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension) (CVSS 6.4)
- CVE-2024-13362 — Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter (CVSS 6.1)
- CVE-2026-2486 — Master Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text' (CVSS 6.4)
- CVE-2023-40679 — WordPress Master Elementor Addons plugin <= 2.0.5.3 - Broken Access Control vulnerability (CVSS 6.5)
- CVE-2025-8874 — Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox (CVSS 6.4)
- CVE-2025-5284 — Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- CVE-2025-0433 — Master Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 5.4)
- CVE-2024-9618 — Master Addons <= 2.0.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 5.4)
- CVE-2024-9502 — Master Addons -- Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip Module (CVSS 5.4)
- CVE-2022-4974 — Freemius SDK <= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- CVE-2024-6282 — Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-jltma-wrapper-link Element (CVSS 5.4)
- CVE-2024-38710 — WordPress Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin <= 2.0.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 4.8)
- CVE-2024-35660 — WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on API vulnerability (CVSS 9.8)
- CVE-2024-35702 — WordPress Master Addons for Elementor plugin <= 2.0.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
- CVE-2024-35688 — WordPress Master Addons for Elementor plugin <= 2.0.5.9 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
- CVE-2024-5542 — Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Navigation Menu Widget (CVSS 6.1)
- CVE-2024-5382 — Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to MA Template Creation or Modification (CVSS 5.3)
- CVE-2024-3134 — Master Addons for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
- CVE-2024-4580 — Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
- CVE-2024-4265 — Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.5.9 - Contributor+ Stored Cross-Site Scripting (CVSS 5.4)
- CVE-2024-33595 — WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on Duplicate Post vulnerability (CVSS 8.8)
- CVE-2024-29911 — WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
- CVE-2024-2139 — Master Addons for Elementor <= 2.0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget (CVSS 5.4)