CVE-2024-52387: Master Addons for Elementor XSS Flaw

CVE-2024-52387 Overview

CVE-2024-52387 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Master Addons for Elementor WordPress plugin. This vulnerability stems from improper neutralization of input during web page generation (CWE-79), allowing attackers to inject malicious scripts that persist in the application and execute whenever users access the affected pages.

The Master Addons for Elementor plugin extends the Elementor page builder with additional widgets and features. Due to insufficient input sanitization, attackers with contributor-level access or higher can inject arbitrary JavaScript code that gets stored and executed in victims' browsers when they view the compromised content.

Critical Impact

Attackers can execute arbitrary JavaScript in authenticated users' browsers, potentially stealing session cookies, performing actions on behalf of victims, defacing websites, or redirecting users to malicious sites.

Affected Products

• Master Addons for Elementor plugin versions up to and including 2.0.9.9.4
• WordPress installations using vulnerable versions of this plugin
• Websites utilizing Elementor page builder with Master Addons extension

Discovery Timeline

• 2026-02-20 - CVE CVE-2024-52387 published to NVD
• 2026-02-20 - Last updated in NVD database

Technical Details for CVE-2024-52387

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability occurs when the Master Addons for Elementor plugin fails to properly sanitize user-supplied input before storing it in the database and rendering it on web pages. Unlike reflected XSS attacks, stored XSS persists within the application, meaning the malicious payload is permanently stored on the target server and delivered to users whenever they access the affected page or feature.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which describes conditions where user-controllable input is placed into output used as a web page without proper encoding or validation. In WordPress plugin contexts, this typically affects custom widget fields, shortcode attributes, or settings panels that accept user input.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and output encoding within the Master Addons for Elementor plugin. The plugin likely accepts user input through Elementor widget fields or custom elements without properly sanitizing special characters such as <, >, ", ', and &. When this unsanitized content is later rendered on the page, the browser interprets injected script tags as legitimate code rather than display text.

WordPress provides multiple sanitization functions like wp_kses(), esc_html(), esc_attr(), and sanitize_text_field() that should be applied to all user inputs. The absence or improper use of these functions allows attackers to bypass security controls and inject executable content.

Attack Vector

The attack requires an authenticated user with at least contributor-level privileges on the WordPress site. The attacker creates or edits a page or post using the Elementor editor and inserts a Master Addons widget. Within the vulnerable widget field, the attacker injects malicious JavaScript code disguised within HTML attributes or script tags.

When the page is published or previewed, any user visiting that page—including administrators—will have the malicious script execute in their browser context. This enables the attacker to steal authentication cookies, capture keystrokes, modify page content, or perform actions as the victim user. The persistent nature of this attack means it continues to affect users until the malicious content is discovered and removed.

Detection Methods for CVE-2024-52387

Indicators of Compromise

• Unexpected JavaScript code or suspicious <script> tags within Elementor-generated page content
• Unusual widget configurations in Master Addons elements containing encoded characters or script patterns
• Browser console errors indicating blocked or executed inline scripts from page content
• Reports of unexpected redirects, pop-ups, or behavior from site visitors

Detection Strategies

• Review WordPress database (wp_postmeta table) for Elementor content containing suspicious script patterns or event handlers
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Monitor web application firewall (WAF) logs for XSS payload patterns in POST requests to admin-ajax.php or Elementor endpoints
• Conduct regular security audits of Elementor-generated content using WordPress security scanning plugins

Monitoring Recommendations

• Enable detailed logging for WordPress admin actions, particularly page and post modifications
• Configure alerts for new or modified pages containing potential XSS patterns like javascript:, onerror=, onload=, or <script>
• Monitor for privilege escalation attempts or suspicious admin account activity following page edits
• Implement real-time monitoring for outbound connections to unknown external domains from the WordPress site

How to Mitigate CVE-2024-52387

Immediate Actions Required

• Update Master Addons for Elementor plugin to the latest patched version immediately
• Review all existing Elementor pages for signs of injected malicious scripts, particularly in Master Addons widgets
• Audit user accounts with contributor access or higher and remove unnecessary privileges
• Consider temporarily disabling the plugin until the update is applied if immediate patching is not possible

Patch Information

A security patch addressing this vulnerability has been released by the plugin developers. Refer to the Patchstack Vulnerability Advisory for detailed patch information and remediation guidance.

Update the plugin through the WordPress admin dashboard:

1. Navigate to Plugins → Installed Plugins
2. Locate Master Addons for Elementor
3. Click "Update Now" if an update is available

Alternatively, download the latest version from the WordPress plugin repository and perform a manual update.

Workarounds

• Restrict contributor and author-level access to trusted users only until the plugin is updated
• Implement a Web Application Firewall (WAF) with XSS protection rules to filter malicious input
• Configure Content Security Policy headers to prevent inline script execution: Content-Security-Policy: script-src 'self'
• Use WordPress security plugins like Wordfence or Sucuri to monitor for and block XSS attempts

# Add CSP header in .htaccess for Apache servers
Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://trusted-cdn.com; style-src 'self' 'unsafe-inline';"

# For Nginx, add to server block
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://trusted-cdn.com; style-src 'self' 'unsafe-inline';";