CVE-2026-9281: LITONICE13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits

Medium severity, CVSS 6.4. EPSS: 0.4% chance of exploitation in the next 30 days.

The Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension) in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unfiltered_html capability check is only enforced during Elementor control registration (UI rendering) and not during the save process, enabling Author-level users to inject the jtlma_custom_js setting directly via a crafted POST request to admin-ajax.php?action=elementor_ajax, bypassing the UI-level restriction entirely.

Affected products

• LITONICE13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits: up to and including 3.1.0

Published 2026-06-06. Last modified 2026-07-23.