CVE-2025-63055
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Stored XSS vulnerability in Master Addons for Elementor plugin by Liton Arefin. Improper input neutralization during web page generation allows persistent script injection.
Risk Assessment
Malicious script can be stored on the server and executed every time the page is viewed, potentially leading to data theft, admin account takeover, or malware distribution.
Recommendation
Update Master Addons for Elementor plugin to a version newer than 2.0.9.9.4, which includes a fix for this vulnerability.
Other vulnerabilities in Master Addons for Elementor
See all- CVE-2026-91015Medium
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor. This allows unauthenticated attackers to permanently disable any popup on the site.
- CVE-2026-62089High
The Master Addons for Elementor plugin by Pixar Labs in versions up to and including 3.2.2 contains a missing authorization vulnerability allowing privilege abuse. An unauthorized user can perform operations they should not have access to.
- CVE-2026-75921High
The Master Addons for Elementor plugin for WordPress up to version 3.1.9 is vulnerable to arbitrary file upload via the upload_template_kit function. This is due to incorrect authorization on the AJAX handler, which requires only upload_files capability instead of manage_options, combined with missing file type filtering after ZIP extraction. This allows authenticated attackers with editor-level access and above to upload executable files, leading to remote code execution.
- CVE-2026-9281Medium
The Master Addons For Elementor plugin for WordPress up to version 3.1.0 is vulnerable to Stored Cross-Site Scripting via the 'jtlma_custom_js' Page Setting due to insufficient input sanitization and output escaping.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through <= 2.0.9.9.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS