Master Addons for Elementor <= 2.0.9.9.4 - Unauthenticated Insecure Direct Object Reference

Wordfence Intelligence   >   Vulnerability Database   >   Master Addons for Elementor <= 2.0.9.9.4 - Unauthenticated Insecure Direct Object Reference
5.3
Authorization Bypass Through User-Controlled Key
CVE CVE-2025-63053
CVSS 5.3 (Medium)
Publicly Published December 31, 2025
Last Updated January 27, 2026
Researcher Mdr

Description

The Master Addons For Elementor – White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9.9.4 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

References

Share

Vulnerability Details for Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Software Type Plugin
Software Slug master-addons (view on wordpress.org)
Patched? Yes
Remediation Update to version 2.1.0, or a newer patched version
Affected Version
  • <= 2.0.9.9.4
Patched Version
  • 2.1.0

Recent vulnerabilities in Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension)
6.4
CVE-2026-9281
Jun 5, 2026
Researchers: Kyokito, Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777)
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
6.1
CVE-2024-13362
Apr 30, 2026
Researcher: Asaf Mozes
Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits <= 2.1.3 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2026-32462
Mar 16, 2026
Researcher: blank
Master Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text'
6.4
CVE-2026-2486
Feb 19, 2026
Researcher: Thanakorn Bunsin
Master Addons for Elementor <= 2.0.9.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-63055
Dec 5, 2025
Researcher: Abu Hurayra (HurayraIIT)
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox
6.4
CVE-2025-8874
Aug 11, 2025
Researcher: Webbernaut
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-5284
Jul 15, 2025
Researcher: zer0gh0st
Master Addons <= 2.0.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
6.4
CVE-2024-9618
Mar 3, 2025
Researcher: Webbernaut
Master Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
6.4
CVE-2025-0433
Mar 3, 2025
Researcher: stealthcopter
Master Addons -- Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip Module
6.4
CVE-2024-9502
Jan 6, 2025
Researcher: Robert DeVore
# Title CVE ID CVSS Researchers Date
1 Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension) CVE-2026-9281 6.4 Kyokito, Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777) June 5, 2026
2 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVE-2024-13362 6.1 Asaf Mozes April 30, 2026
3 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits <= 2.1.3 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2026-32462 6.4 blank March 16, 2026
4 Master Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text' CVE-2026-2486 6.4 Thanakorn Bunsin February 19, 2026
5 Master Addons for Elementor <= 2.0.9.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-63055 6.4 Abu Hurayra (HurayraIIT) December 5, 2025
6 Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox CVE-2025-8874 6.4 Webbernaut August 11, 2025
7 Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-5284 6.4 zer0gh0st July 15, 2025
8 Master Addons <= 2.0.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets CVE-2024-9618 6.4 Webbernaut March 3, 2025
9 Master Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter CVE-2025-0433 6.4 stealthcopter March 3, 2025
10 Master Addons -- Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip Module CVE-2024-9502 6.4 Robert DeVore January 6, 2025
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation