The Master Addons For Elementor plugin allows an authenticated author‑level user to store arbitrary JavaScript in the jtlma_custom_js page setting. Because the plugin does not properly sanitize or escape this input during the save process, the script is persisted and executed whenever any visitor accesses the affected page, creating a classic stored XSS scenario. This flaw may lead to disclosure of sensitive data, manipulation of page content, and phishing or session hijacking on a site level. The weakness is a traditional input validation issue categorized as CWE‑79.

WordPress sites running the Master Addons For Elementor plugin version 3.1.0 or earlier are affected. The plugin is developed by litonice13 and is used in various theme builders, widget packs, and popup builders for Elementor. All releases up to and including 3.1.0 are explicitly listed as vulnerable; no patch is available for the documented plugin version history for 3.1.0, so any site using that or earlier releases is exposed.

The CVSS score of 6.4 reflects moderate severity. EPSS is not available, so an exact exploitation probability cannot be determined, but the lack of a KEV listing indicates the vulnerability has not yet been widely exploited. Attackers need author‑level or higher access and must submit a crafted POST request to admin-ajax.php?action=elementor_ajax, bypassing UI restrictions. Once injected, the malicious script runs in the context of any visitor to the page, potentially compromising credentials and session data.