Master Addons for Elementor vulnerabilities

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor. This allows unauthenticated attackers to permanently disable any popup on the site.

The Master Addons for Elementor plugin by Pixar Labs in versions up to and including 3.2.2 contains a missing authorization vulnerability allowing privilege abuse. An unauthorized user can perform operations they should not have access to.

The Master Addons for Elementor plugin for WordPress up to version 3.1.9 is vulnerable to arbitrary file upload via the upload_template_kit function. This is due to incorrect authorization on the AJAX handler, which requires only upload_files capability instead of manage_options, combined with missing file type filtering after ZIP extraction. This allows authenticated attackers with editor-level access and above to upload executable files, leading to remote code execution.

The Master Addons For Elementor plugin for WordPress up to version 3.1.0 is vulnerable to Stored Cross-Site Scripting via the 'jtlma_custom_js' Page Setting due to insufficient input sanitization and output escaping.

Stored XSS vulnerability in Master Addons for Elementor plugin by Liton Arefin. Improper input neutralization during web page generation allows persistent script injection.