{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Master Addons For Elementor \u2013 Widgets, Extensions, Theme Builder, Popup Builder \u0026 Template Kits",
          "vendor": "litonice13",
          "versions": [
            {
              "lessThanOrEqual": "3.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@wordfence.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Master Addons For Elementor \u2013 Widgets, Extensions, Theme Builder, Popup Builder \u0026 Template Kits plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027jtlma_custom_js\u0027 Page Setting (Custom JS Extension) in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unfiltered_html capability check is only enforced during Elementor control registration (UI rendering) and not during the save process, enabling Author-level users to inject the jtlma_custom_js setting directly via a crafted POST request to admin-ajax.php?action=elementor_ajax, bypassing the UI-level restriction entirely."
    },
    {
      "lang": "es",
      "value": "El plugin Master Addons For Elementor - Widgets, Extensions, Theme Builder, Popup Builder \u0026 Template Kits para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s de la configuraci\u00f3n de p\u00e1gina \u0027jtlma_custom_js\u0027 (Extensi\u00f3n JS Personalizada) en todas las versiones hasta la 3.1.0, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes autenticados, con acceso de nivel de autor y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. La verificaci\u00f3n de capacidad unfiltered_html solo se aplica durante el registro de control de Elementor (renderizado de la interfaz de usuario) y no durante el proceso de guardado, lo que permite a los usuarios de nivel de autor inyectar la configuraci\u00f3n jtlma_custom_js directamente a trav\u00e9s de una solicitud POST manipulada a admin-ajax.php?action=elementor_ajax, eludiendo por completo la restricci\u00f3n a nivel de interfaz de usuario."
    }
  ],
  "id": "CVE-2026-9281",
  "lastModified": "2026-07-23T07:10:00.113",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 2.7,
        "source": "security@wordfence.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-9281",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-06T11:35:43.472795Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-06T02:16:22.820",
  "references": [
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/master-addons/tags/3.0.2/inc/modules/utilities/custom-js/custom-js.php#L206"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/master-addons/tags/3.0.2/inc/modules/utilities/custom-js/custom-js.php#L214"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/master-addons/tags/3.0.2/inc/modules/utilities/custom-js/custom-js.php#L80"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/master-addons/tags/3.1.0/inc/modules/utilities/custom-js/custom-js.php#L206"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/master-addons/tags/3.1.0/inc/modules/utilities/custom-js/custom-js.php#L214"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/master-addons/tags/3.1.0/inc/modules/utilities/custom-js/custom-js.php#L80"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3556818%40master-addons\u0026new=3556818%40master-addons\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "source": "security@wordfence.com",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5b8e052a-6e60-4455-96c9-b2a3e86773da?source=cve"
    }
  ],
  "sourceIdentifier": "security@wordfence.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security@wordfence.com",
      "type": "Secondary"
    }
  ]
}