CVE-2026-91015
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor. This allows unauthenticated attackers to permanently disable any popup on the site.
Risk Assessment
An attacker can permanently disable popups on the site, potentially disrupting marketing communications, important information display, or conversion features. The risk affects the integrity and availability of site content.
Recommendation
Update the Master Addons for Elementor plugin to version 3.1.9 or later. Check whether any popups have been unauthorizedly disabled.
Other vulnerabilities in Master Addons for Elementor
See all- CVE-2026-62089High
The Master Addons for Elementor plugin by Pixar Labs in versions up to and including 3.2.2 contains a missing authorization vulnerability allowing privilege abuse. An unauthorized user can perform operations they should not have access to.
- CVE-2026-75921High
The Master Addons for Elementor plugin for WordPress up to version 3.1.9 is vulnerable to arbitrary file upload via the upload_template_kit function. This is due to incorrect authorization on the AJAX handler, which requires only upload_files capability instead of manage_options, combined with missing file type filtering after ZIP extraction. This allows authenticated attackers with editor-level access and above to upload executable files, leading to remote code execution.
- CVE-2026-9281Medium
The Master Addons For Elementor plugin for WordPress up to version 3.1.0 is vulnerable to Stored Cross-Site Scripting via the 'jtlma_custom_js' Page Setting due to insufficient input sanitization and output escaping.
Original NVD description (English source)
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup on the site.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS