Vulnerabilities

TI-2026-02704 CVE-2026-3132 · GHSA-32r9-7227-vg6h

Master Addons for Elementor Premium <= 2.1.3 - Authenticated (Subscriber+) Remote Code Execution via render_preview

MEDIUM 41

The Master Addons for Elementor Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.3 via the 'JLTMA_Widget_Admin::render_preview'.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00693 Published 2026-03-02 No fix listed CWE-94

TI-2023-21471 CVE-2023-40679 · GHSA-6j54-x24w-xmph

WordPress Master Elementor Addons plugin <= 2.0.5.3 - Broken Access Control vulnerability

LOW 35

Missing Authorization vulnerability in Jewel Theme Master Addons for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Master Addons for Elementor: from n/a through 2.0.…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00371 Published 2025-12-24 No fix listed CWE-862

TI-2024-25944 CVE-2024-38710 · GHSA-2x77-g6vw-wxgr

Cross-site scripting in Jewel Theme Master Addons for Elementor

LOW 26

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jewel Theme Master Addons for Elementor allows Stored XSS.This issue affects Master Addons for Elementor: from…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.0026 Published 2024-07-20 No fix listed CWE-79

TI-2024-23529 CVE-2024-35660 · GHSA-mgfm-fq92-x2r7

WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on API vulnerability

MEDIUM 48

Missing Authorization vulnerability in Jewel Theme Master Addons for Elementor.This issue affects Master Addons for Elementor: from n/a through 2.0.5.4.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00397 Published 2024-06-09 No fix listed CWE-862

TI-2024-23557 CVE-2024-35688 · GHSA-4v3f-8w78-rm7j

WordPress Master Addons for Elementor plugin <= 2.0.5.9 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jewel Theme Master Addons for Elementor allows Stored XSS.This issue affects Master Addons for Elementor: from…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0026 Published 2024-06-08 No fix listed CWE-79

TI-2024-23571 CVE-2024-35702 · GHSA-4gfv-46xr-qrjq

WordPress Master Addons for Elementor plugin <= 2.0.6.0 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jewel Theme Master Addons for Elementor allows Stored XSS.This issue affects Master Addons for Elementor: from…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00237 Published 2024-06-08 No fix listed CWE-79

TI-2024-22182 CVE-2024-33595 · GHSA-hv3r-8m2g-v7cq

WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on Duplicate Post vulnerability

LOW 38

Missing Authorization vulnerability in Jewel Theme Master Addons for Elementor.This issue affects Master Addons for Elementor: from n/a through 2.0.5.4.1.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00448 Published 2024-04-29 No fix listed CWE-862

TI-2024-19678 CVE-2024-29911 · GHSA-2jq5-wq32-4rfq

WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Cross Site Scripting (XSS) vulnerability

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jewel Theme Master Addons for Elementor allows Stored XSS.This issue affects Master Addons for Elementor: from n/a thr…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00343 Published 2024-03-27 No fix listed CWE-79

TI-2023-28571 CVE-2023-52132 · GHSA-pm97-4h32-f6p7

WordPress WP Adminify Plugin <= 3.1.6 is vulnerable to SQL Injection

LOW 34

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jewel Theme WP Adminify.This issue affects WP Adminify: from n/a through 3.1.6.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00541 Published 2023-12-31 No fix listed CWE-89

TI-2023-23792 CVE-2023-44266 · GHSA-8jjv-wx3r-m7x9

WordPress WP Adminify Plugin <= 3.1.6 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jewel Theme WP Adminify plugin <= 3.1.6 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00392 Published 2023-10-02 No fix listed CWE-79

TI-2022-00255 CVE-2022-0327 · GHSA-f2m2-ghcc-gv83

Master Addons for Elementor < 1.8.2 - Reflected Cross-Site Scripting

LOW 29

The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX action, available to una…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00795 Published 2022-03-14 Fixed in 1.8.5 CWE-79

Vulnerabilities

Filters