The Master Addons For Elementor WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. This allows authenticated contributors or higher to inject malicious scripts via multiple widgets because user input is not properly sanitized or escaped. The vulnerability affects all versions up to and including 2.0.7.2. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at contributor level, no user interaction, and impacts on confidentiality and integrity with no availability impact. No patch or official remediation has been published by the vendor as of the data provided.

An attacker with contributor-level access or higher can exploit this vulnerability to inject and store malicious scripts within pages generated by the plugin's widgets. These scripts execute in the context of users who view the compromised pages, potentially leading to unauthorized actions such as session hijacking or data theft. The impact affects confidentiality and integrity but does not affect availability. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the affected widgets. Monitor for updates from the vendor and apply patches promptly once available.