Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension) in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unfiltered_html capability check is only enforced during Elementor control registration (UI rendering) and not during the save process, enabling Author-level users to inject the jtlma_custom_js setting directly via a crafted POST request to admin-ajax.php?action=elementor_ajax, bypassing the UI-level restriction entirely.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-07 | 1 | Disclosure1 |
| 2026-06-12 | 1 | PoC1 |
CVE-2026-9281 The Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi… https://www.cve.org/CVERecord?id=CVE-2026-9281
Post summary
CVE-2026-9281 reports a stored XSS flaw in the Master Addons for Elementor WordPress plugin; no exploit, patch, or wild usage is mentioned.
https://atomicedge.io/cve-proof/cve-2026-9281-master-addons-version-3-1-0-medium-vulnerability-proof-of-concept CVE-2026-9281 master-addons (CVSS Score 6.4) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge #…
Post summary
The post announces a proof‑of‑concept for CVE‑2026‑9281 in the WordPress master‑addons plugin, noting a medium CVSS score but providing no details on active exploitation, patch status, or technical vulnerability specifics.