WordPress plugin · master-addons
Is Master Addons for Elementor safe?
Safe on 3.2.3 or newer.
The current version, 3.2.3, is past every affected range on record (31 of 31 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 31
- High or critical
- 5
- Exploited
- none
- Current version
- 3.2.3
- Last updated
- Sep 10, 2026
- Active installs
- 30,000+
Every recorded flaw
- Sep 18, 2026The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerableCVE-2026-85410 · affects up to 3.2.2 · reported by WordfenceHigh 8.1
- Sep 17, 2026Master Addons for Elementor: Does not perform an authorization check on the AJAX action that deactivates its Popup Builder popupsCVE-2026-91015 · fixed in 3.1.9 · reported by WPScanMedium 5.3
- Sep 11, 2026Master Addons for Elementor: Missing AuthorizationCVE-2026-62089 · affects up to 3.2.2 · reported by PatchstackHigh 7.1
- Sep 1, 2026The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerableCVE-2026-75921 · affects up to 3.1.9 · reported by Wordfence1.2% oddsHigh 7.2
- Jun 5, 2026Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits: Stored Cross-Site ScriptingCVE-2026-9281 · affects up to 3.1.0 · reported by WordfenceMedium 6.4
- Mar 13, 2026Master Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32462 · affects up to 2.1.3 · reported by PatchstackMedium 5.9
- Mar 2, 2026Master Addons for Elementor Premium: Remote Code ExecutionCVE-2026-3132 · affects up to 2.1.3 · reported by WordfenceHigh 8.8
- Feb 20, 2026Master Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52387 · affects up to 2.0.9.9.4 · reported by PatchstackMedium 5.9
- Feb 20, 2026Master Addons For Elementor: Stored Cross-Site ScriptingCVE-2026-2486 · affects up to 2.1.1 · reported by WordfenceMedium 6.4
- Dec 31, 2025Master Addons for Elementor: Authorization Bypass Through User-Controlled KeyCVE-2025-63053 · affects up to 2.0.9.9.4 · reported by PatchstackMedium 5.3
- Dec 24, 2025Master Addons for Elementor: Missing AuthorizationCVE-2023-40679 · affects up to 2.0.5.3 · reported by PatchstackMedium 6.5
- Dec 9, 2025Master Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63055 · affects up to 2.0.9.9.4 · reported by PatchstackMedium 6.5
- Aug 12, 2025Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Stored Cross-Site ScriptingCVE-2025-8874 · affects up to 2.0.8.6 · reported by WordfenceMedium 6.4
- Jul 16, 2025Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Stored Cross-Site ScriptingCVE-2025-5284 · affects up to 2.0.8.2 · reported by WordfenceMedium 6.4
- Mar 4, 2025Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Stored Cross-Site ScriptingCVE-2025-0433 · affects up to 2.0.7.1 · reported by WordfenceMedium 6.4
- Mar 4, 2025Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Stored Cross-Site ScriptingCVE-2024-9618 · affects up to 2.0.7.2 · reported by WordfenceMedium 6.4
- Jan 7, 2025Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Stored Cross-Site ScriptingCVE-2024-9502 · affects up to 2.0.6.7 · reported by WordfenceMedium 6.4
- Sep 10, 2024Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Stored Cross-Site ScriptingCVE-2024-6282 · affects up to 2.0.6.4 · reported by WordfenceMedium 5.4
- Jul 20, 2024Master Addons for Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38710 · affects up to 2.0.6.2 · reported by PatchstackMedium 5.9
- Jun 9, 2024Master Addons for Elementor: Missing AuthorizationCVE-2024-35660 · affects up to 2.0.5.4.1 · reported by PatchstackMedium 6.5
- Jun 8, 2024Master Addons for Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35702 · affects up to 2.0.6.0 · reported by PatchstackMedium 6.5
- Jun 8, 2024Master Addons for Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35688 · affects up to 2.0.5.9 · reported by PatchstackMedium 6.5
- Jun 7, 2024Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Stored Cross-Site ScriptingCVE-2024-5542 · affects up to 2.0.6.1 · reported by WordfenceHigh 7.2
- Jun 7, 2024Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Unauthorized modification of dataCVE-2024-5382 · affects up to 2.0.6.1 · reported by WordfenceMedium 6.5
- May 16, 2024Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Stored Cross-Site ScriptingCVE-2024-3134 · affects up to 2.0.6.0 · reported by WordfenceMedium 6.4
- May 16, 2024Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Stored Cross-Site ScriptingCVE-2024-4580 · affects up to 2.0.6.0 · reported by WordfenceMedium 6.4
- May 2, 2024Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Stored Cross-Site ScriptingCVE-2024-4265 · affects up to 2.0.5.9 · reported by WordfenceMedium 6.4
- Apr 29, 2024Master Addons for Elementor: Missing AuthorizationCVE-2024-33595 · affects up to 2.0.5.4.1 · reported by PatchstackMedium 4.3
- Mar 27, 2024Master Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29911 · affects up to 2.0.5.4.1 · reported by PatchstackMedium 6.5
- Mar 26, 2024Master Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-2139 · affects up to 2.0.5.6 · reported by WordfenceMedium 6.4
- Mar 14, 2022Master Addons for Elementor: Does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX actionCVE-2022-0327 · fixed in 1.8.5 · reported by WPScanMedium 6.1
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.