The Master Addons For Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation (CWE-79). Authenticated users with contributor-level permissions or above can inject arbitrary web scripts via several parameters. These scripts persist and execute in the context of users viewing the injected pages. The vulnerability affects versions up to 2.0.6.0. No patch or remediation guidance is currently documented by the vendor. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at contributor level, no user interaction, and partial impact on confidentiality and integrity.

An attacker with contributor-level or higher permissions can inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to partial compromise of confidentiality and integrity of user data within the affected WordPress site. There is no indication of impact on availability. No known exploits in the wild have been reported. The vulnerability could facilitate unauthorized actions or data theft within the context of the affected site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level permissions to trusted users only and consider monitoring for suspicious activity related to script injection. Avoid granting contributor or higher permissions to untrusted users. Review and sanitize user-generated content manually if possible.