The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in its Navigation Menu widget within the Mega Menu extension. This vulnerability arises from improper neutralization of input during web page generation, specifically due to insufficient input sanitization and output escaping of user-supplied attributes. As a result, unauthenticated attackers can inject arbitrary web scripts that persist and execute in the context of any user accessing the compromised page. The issue affects all plugin versions up to and including 2.0.6.1. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope change.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary JavaScript in the context of users visiting affected pages, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity. There is no indication of impact on availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the vulnerable Navigation Menu widget or Mega Menu extension if feasible. Applying strict input validation and output escaping at the application level may mitigate risk but requires developer intervention. Monitor vendor channels for updates and apply patches promptly once available.