CVE-2026-9281 is a stored cross-site scripting vulnerability in the Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits WordPress plugin. The issue exists in the 'jtlma_custom_js' Page Setting (Custom JS Extension) due to insufficient sanitization and escaping of user input. Authenticated attackers with author-level permissions or higher can exploit this by sending a crafted POST request to admin-ajax.php?action=elementor_ajax, injecting malicious JavaScript that executes when the page is accessed. The unfiltered_html capability check is only applied during UI rendering, not during the save operation, allowing bypass of intended restrictions. This affects all versions up to and including 3.1.0.

An attacker with author-level access can inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to theft of user credentials, session hijacking, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity of user interactions with the affected site.

No official patch or fix has been confirmed as of the published date. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict author-level access to trusted users only and consider disabling or limiting use of the Custom JS Extension feature. Applying strict input validation and output escaping at the application level may help mitigate risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.