This vulnerability allows authenticated users with contributor-level access or higher to inject arbitrary JavaScript through the "ma_el_bh_table_btn_text" field in the Master Addons For Elementor WordPress plugin. The input is not sanitized or escaped, so scripts are stored and later executed whenever the affected page is viewed by any user. The flaw enables malicious code execution, defacement, data theft or session hijacking within the context of the affected site.

The affected product is Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits by litonice13. Versions up to and including 2.1.1 are vulnerable; the fix is released in 2.1.2.

The severity is CVSS 6.4 (Medium) with a very low EPSS (<1%) and it is not listed in the CISA KEV catalog. Exploitation requires a valid contributor or higher account, so the attack surface is limited to authorized users. Nonetheless, once injected scripts run, they can compromise any site visitor, leading to potential data loss, credential theft, or further site compromise, especially if additional plugins or themes are vulnerable to XSS.