PatchSiren cyber security CVE debrief
CVE-2026-9281 litonice13 CVE debrief
The Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension) in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Vendor
- litonice13
- Product
- Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits
- CVSS
- MEDIUM 6.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-06
- Original CVE updated
- 2026-07-23
- Advisory published
- 2026-06-06
- Advisory updated
- 2026-07-23
Who should care
Users of the Master Addons For Elementor plugin for WordPress, particularly those with author-level access and above, should be aware of this vulnerability and take steps to mitigate it.
Technical summary
The vulnerability exists in the 'jtlma_custom_js' Page Setting (Custom JS Extension) of the Master Addons For Elementor plugin. The unfiltered_html capability check is only enforced during Elementor control registration (UI rendering) and not during the save process, enabling Author-level users to inject the jtlma_custom_js setting directly via a crafted POST request to admin-ajax.php?action=elementor_ajax, bypassing the UI-level restriction entirely.
Defensive priority
MEDIUM
Recommended defensive actions
- Update the Master Addons For Elementor plugin to a version beyond 3.1.0.
- Restrict access to the admin-ajax.php file to prevent unauthorized requests.
- Monitor for suspicious activity, particularly injected scripts.
Evidence notes
The CVE-2026-9281 record and associated details can be found at [cve-org](https://www.cve.org/CVERecord?id=CVE-2026-9281). Additional information and references are available at [nvd](https://nvd.nist.gov/vuln/detail/CVE-2026-9281).
Sources and references
Verified primary and authoritative sources
-
CVE-2026-9281 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-9281
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-9281 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9281
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/master-addons/tags/3.0.2/inc/modules/utilities/custom-js/custom-js.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/master-addons/tags/3.0.2/inc/modules/utilities/custom-js/custom-js.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/master-addons/tags/3.0.2/inc/modules/utilities/custom-js/custom-js.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/master-addons/tags/3.1.0/inc/modules/utilities/custom-js/custom-js.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/master-addons/tags/3.1.0/inc/modules/utilities/custom-js/custom-js.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/master-addons/tags/3.1.0/inc/modules/utilities/custom-js/custom-js.php
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.