CVE-2026-2486: Master Addons Elementor XSS Vulnerability

CVE-2026-2486 Overview

The Master Addons For Elementor plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the ma_el_bh_table_btn_text parameter. This vulnerability affects versions up to and including 2.1.1 and stems from insufficient input sanitization and output escaping in the Business Hours addon component.

This flaw enables authenticated attackers with contributor-level access or higher to inject malicious JavaScript code into WordPress pages. The injected scripts persist in the database and execute automatically whenever any user—including administrators—views the compromised page, making this a particularly dangerous attack vector.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in the context of victim browsers, potentially leading to session hijacking, credential theft, administrative account takeover, and website defacement.

Affected Products

• Master Addons For Elementor plugin versions up to and including 2.1.1
• WordPress installations using the vulnerable plugin versions
• Websites utilizing the Business Hours addon feature

Discovery Timeline

• 2026-02-20 - CVE-2026-2486 published to NVD
• 2026-02-20 - Last updated in NVD database

Technical Details for CVE-2026-2486

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists within the Business Hours addon component of the Master Addons For Elementor plugin. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

The core issue lies in how the plugin handles the ma_el_bh_table_btn_text parameter. When users with contributor privileges or above create or edit content using the Business Hours addon, the parameter value is stored directly in the database without proper sanitization. Subsequently, when the page renders, this stored content is output without adequate escaping, allowing embedded JavaScript to execute in visitors' browsers.

The attack requires only contributor-level authentication, which is significant because many WordPress sites grant contributor access to multiple users. Once malicious content is injected, it persists and affects all users who view the compromised page, including administrators.

Root Cause

The vulnerability originates from a failure to implement proper input validation and output encoding in the ma-business-hours.php file. Specifically:

1. Missing Input Sanitization: The ma_el_bh_table_btn_text parameter accepts user input without sanitizing potentially dangerous HTML and JavaScript content
2. Inadequate Output Escaping: When rendering the stored parameter value, the plugin fails to apply WordPress escaping functions such as esc_html() or esc_attr() to neutralize script content
3. Trust Boundary Violation: The plugin implicitly trusts input from authenticated users without considering that contributor-level users should not be able to inject arbitrary scripts

Attack Vector

The attack is conducted over the network and requires low-privilege authentication (contributor-level access). An attacker would:

1. Authenticate to WordPress with contributor or higher privileges
2. Create or edit a page/post using the Elementor editor
3. Add the Business Hours addon element to the page
4. Insert malicious JavaScript payload into the ma_el_bh_table_btn_text field
5. Save or publish the page to persist the malicious content

When any user subsequently visits the page, the stored script executes in their browser context. This can facilitate session cookie theft, keylogging, credential harvesting, or redirects to malicious sites. The stored nature of the XSS means the attack payload remains active until the malicious content is manually removed.

The vulnerability is documented in the WordPress Plugin Changeset which shows the fix applied in version 2.1.2.

Detection Methods for CVE-2026-2486

Indicators of Compromise

• Unexpected JavaScript code present in WordPress page/post content containing the Business Hours addon
• Suspicious <script> tags or event handlers (e.g., onerror, onload) within ma_el_bh_table_btn_text field values in the database
• Reports from users about unexpected browser behavior, redirects, or pop-ups when viewing specific pages
• Unusual network requests originating from the WordPress frontend to external domains

Detection Strategies

• Review WordPress database entries in the wp_postmeta table for posts containing Business Hours elements with suspicious script content
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Deploy web application firewall (WAF) rules to detect XSS patterns in form submissions to the WordPress admin
• Monitor for changes to posts made by contributor-level accounts that include script-like content

Monitoring Recommendations

• Enable WordPress audit logging to track all post modifications by contributor accounts
• Configure real-time alerts for database entries containing script tags or JavaScript event handlers in Elementor widget data
• Implement browser-based XSS detection through CSP violation reporting endpoints
• Regularly scan WordPress installations using security plugins that detect stored XSS payloads

How to Mitigate CVE-2026-2486

Immediate Actions Required

• Update the Master Addons For Elementor plugin to version 2.1.2 or later immediately
• Audit all pages and posts containing Business Hours addon elements for suspicious JavaScript content
• Review recent content changes made by contributor-level users for potential exploitation attempts
• Consider temporarily restricting contributor access until the patch is applied

Patch Information

The vulnerability has been addressed in Master Addons For Elementor version 2.1.2. The fix implements proper input sanitization and output escaping for the ma_el_bh_table_btn_text parameter. The patch details are available in the WordPress Plugin Changeset. Additional vulnerability information is documented in the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable the Business Hours addon if the plugin cannot be immediately updated
• Restrict contributor-level access to trusted users only until the patch is applied
• Implement a Web Application Firewall (WAF) with XSS filtering rules to block malicious payloads
• Add Content Security Policy headers to prevent inline script execution as a defense-in-depth measure

# WordPress CLI command to update the plugin
wp plugin update master-addons --version=2.1.2

# Verify current plugin version
wp plugin list --name=master-addons --fields=name,version,update_version