CVE-2026-9281

The Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension) in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unfiltered_html capability check is only enforced during Elementor control registration (UI rendering) and not during the save process, enabling Author-level users to inject the jtlma_custom_js setting directly via a crafted POST request to admin-ajax.php?action=elementor_ajax, bypassing the UI-level restriction entirely.

• CWE-79

• https://plugins.trac.wordpress.org/browser/master-addons/tags/3.0.2/inc/modules/utilities/custom-js/custom-js.php#L206
• https://plugins.trac.wordpress.org/browser/master-addons/tags/3.0.2/inc/modules/utilities/custom-js/custom-js.php#L214
• https://plugins.trac.wordpress.org/browser/master-addons/tags/3.0.2/inc/modules/utilities/custom-js/custom-js.php#L80
• https://plugins.trac.wordpress.org/browser/master-addons/tags/3.1.0/inc/modules/utilities/custom-js/custom-js.php#L206
• https://plugins.trac.wordpress.org/browser/master-addons/tags/3.1.0/inc/modules/utilities/custom-js/custom-js.php#L214
• https://plugins.trac.wordpress.org/browser/master-addons/tags/3.1.0/inc/modules/utilities/custom-js/custom-js.php#L80
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3556818%40master-addons&new=3556818%40master-addons&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5b8e052a-6e60-4455-96c9-b2a3e86773da?source=cve

Published

Jun 6, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9273The Membership Plugin – Kadence Memberships plugin for WordP…9.3
• CVE-2026-9274This vulnerability exists in CP Plus Wi-Fi Camera due to imp…5.2
• CVE-2026-9277shell-quote's `quote()` function did not validate object-tok…9.2
• CVE-2026-9278The Form Builder CP WordPress plugin before 1.2.47 does not …5.4
• CVE-2026-9279Logseq exposes an IPC handler that allows the renderer proce…8.7
• CVE-2026-9280The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPr…6.1
• CVE-2026-9282The W3 Total Cache plugin for WordPress is vulnerable to Dir…7.5
• CVE-2026-9284The WooCommerce PayPal Payments plugin for WordPress is vuln…8.2
• CVE-2026-9290The WP User Manager – User Profile Builder & Membership plug…7.5
• CVE-2026-9291Insecure deserialization in the job results processing compo…7.5
• CVE-2026-9292A Stored Cross-Site Scripting security issue exists within F…8.4
• CVE-2026-9294A vulnerability was identified in Edimax BR-6428NS 1.10. The…8.8