CVE-2026-9281: Master Addons Elementor XSS Vulnerability

CVE-2026-9281 Overview

CVE-2026-9281 is a Stored Cross-Site Scripting (XSS) vulnerability in the Master Addons For Elementor plugin for WordPress. The flaw affects all versions up to and including 3.1.0. It resides in the jtlma_custom_js page setting exposed by the Custom JS Extension module.

The plugin fails to perform sufficient input sanitization and output escaping on this setting. Authenticated attackers with Author-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who visits the affected page, enabling session hijacking, content manipulation, and downstream account compromise.

Critical Impact
Author-level users can bypass the unfiltered_html capability check by sending crafted requests to admin-ajax.php, allowing persistent JavaScript injection that executes against site visitors and administrators.

Affected Products

Master Addons For Elementor plugin for WordPress (versions ≤ 3.1.0)
WordPress sites using the Custom JS Extension module of Master Addons
WordPress installations granting Author-level roles to untrusted contributors

Discovery Timeline

2026-06-06 - CVE-2026-9281 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-9281

Vulnerability Analysis

The vulnerability is classified as Stored Cross-Site Scripting [CWE-79]. The Custom JS Extension module of Master Addons registers an Elementor control named jtlma_custom_js that accepts raw JavaScript intended for injection into rendered pages.

The plugin enforces the WordPress unfiltered_html capability only during Elementor control registration. This is a UI-side gate that hides the control from low-privileged roles when the editor loads. The save handler that persists the page settings does not re-check this capability or sanitize the submitted value.

As a result, the access control is purely cosmetic. Any authenticated user with permission to edit a post or page, including Author-level accounts, can submit the field directly. The injected JavaScript is stored as page metadata and later emitted into the page output, executing in the context of every visitor.

Root Cause

The root cause is a missing server-side authorization check combined with absent output escaping. The plugin trusts the Elementor editor to filter privileged controls client-side rather than enforcing capability validation in the persistence layer. Relevant source references include inc/modules/utilities/custom-js/custom-js.php lines 80, 206, and 214 in tags 3.0.2 and 3.1.0.

Attack Vector

An attacker first authenticates to WordPress with an Author-level account. They then craft a POST request to admin-ajax.php?action=elementor_ajax that includes the jtlma_custom_js setting populated with arbitrary JavaScript. The request bypasses the Elementor UI entirely, so the missing control in the editor sidebar does not matter.

The injected script is stored against the target page. When any user, including administrators, visits the page, the script executes with the privileges of that user's browser session.

No verified public exploit code is available. For technical details, refer to the Wordfence Vulnerability Report and the WordPress plugin source.

Detection Methods for CVE-2026-9281

Indicators of Compromise

Page or post metadata containing the key jtlma_custom_js with values that include <script>, eval(, document.cookie, or external script URLs.
POST requests to /wp-admin/admin-ajax.php with action=elementor_ajax originating from non-administrator accounts.
Unexpected outbound requests from site visitors to attacker-controlled domains after viewing pages edited by Author-level users.

Detection Strategies

Query the wp_postmeta table for entries with meta_key matching Elementor page settings and inspect serialized values for the jtlma_custom_js key containing script content.
Review WordPress audit logs for elementor_ajax save actions performed by users below Editor role.
Monitor web server logs for crafted POST bodies that include jtlma_custom_js outside of standard editor workflows.

Monitoring Recommendations

Enable plugin and post revision auditing to track which user modified the Elementor settings on each page.
Alert on any new script-tag content appearing in rendered page output for previously clean URLs.
Implement Content Security Policy (CSP) reporting to surface inline script execution that violates expected policy.

How to Mitigate CVE-2026-9281

Immediate Actions Required

Update the Master Addons For Elementor plugin to a version newer than 3.1.0 that includes the fix referenced in WordPress changeset 3556818.
Audit all pages edited by Author-level or Contributor accounts for stored JavaScript in the jtlma_custom_js setting and remove malicious entries.
Rotate administrator session cookies and credentials if injected scripts may have executed in privileged browsers.

Patch Information

The vendor addressed the issue in the changeset published after version 3.1.0. The fix enforces the unfiltered_html capability check during the save process and applies output escaping when rendering the stored JavaScript. Site operators should apply the update through the WordPress plugin manager.

Workarounds

Disable the Custom JS Extension module within Master Addons until the patched version is deployed.
Restrict the Author role from editing pages that use Elementor, or temporarily downgrade untrusted Authors to Contributor without publish rights.
Deploy a Web Application Firewall (WAF) rule blocking admin-ajax.php requests that contain the jtlma_custom_js parameter from non-administrator sessions.

bash

# Example WAF condition (pseudo-rule)
if request.uri matches "/wp-admin/admin-ajax.php"
   and request.body contains "jtlma_custom_js"
   and session.user_role not in ["administrator", "editor"]
then block and log