The Master Addons – Elementor Addons plugin for WordPress contains a stored cross‑site scripting vulnerability that allows an authenticated user with Contributor-level access or higher to inject arbitrary JavaScript through the unfiltered ‘id’ parameter in several plugin components. When the data is persisted and subsequently displayed on a page, the malicious script runs under the identity of the visitor, enabling attackers to steal session data, deface content, or perform further phishing attempts against site users. The weakness arises from insufficient input sanitization and lack of output escaping, which directly maps to CWE‑79.

Affected are all installations of Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits up to and including version 2.0.7.1. Users running any of these versions on WordPress should verify their installed version against the latest release.

The vulnerability has a CVSS score of 6.4, indicating moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. Nonetheless, because the flaw requires only Contributor‑level access, sites with such roles or higher are susceptible. An attacker can exploit the stored XSS by interacting with the plugin’s UI to submit data containing malicious scripts, which will persist and execute when the infected page is rendered for any user. No additional external conditions are required beyond the authentication level.