# Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

> The complete Elementor addons plugin: 55+ widgets for Elementor, Mega Menu Builder, Popup Builder, Widget Builder & Elementor Template Kits.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:31 UTC.

## Facts (WordPress.org)

- Slug: `master-addons`
- Author: Pixar Labs
- Version: 3.2.4
- Active installs: 30,000+
- Last update: 2026-11-12 (1 day ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.0, PHP 7.0
- Tags: elementor addons, elementor widgets, mega menu builder, popup builder, template kits
- Page: https://wordpress.org/plugins/master-addons/

## Checks (against WordPress 7.1.4)

- OK: Updated 1 day ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Slows pages ↔ Speeds up, Locked in ↔ Portable, Breaking ↔ Smooth, Steep ↔ Easy, Inaccessible ↔ Accessible, Behind ↔ Current.

## Known vulnerabilities

- 2026-09-18 HIGH: Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter (up to 3.2.2). CVE-2026-85410, https://www.wordfence.com/threat-intel/vulnerabilities/id/dd1fc16c-f36b-4c39-916d-36833630729e?source=api-prod
- 2026-09-17 MEDIUM: Missing Authorization (up to 3.1.8). CVE-2026-91015, https://www.wordfence.com/threat-intel/vulnerabilities/id/c971731f-7fa1-4ea1-b3b3-3a991f575023?source=api-prod
- 2026-09-11 MEDIUM: Missing Authorization (up to 3.2.2). CVE-2026-62089, https://www.wordfence.com/threat-intel/vulnerabilities/id/fe4b3cab-eda2-45b1-8c38-57bd8381d5b3?source=api-prod
- 2026-09-01 HIGH: Incorrect Authorization to Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extraction (up to 3.1.9). CVE-2026-75921, https://www.wordfence.com/threat-intel/vulnerabilities/id/11314a07-70f7-4a63-837f-4812905a55fe?source=api-prod
- 2026-06-06 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension) (up to 3.1.0). CVE-2026-9281, https://www.wordfence.com/threat-intel/vulnerabilities/id/5b8e052a-6e60-4455-96c9-b2a3e86773da?source=api-prod
- 2026-04-30 MEDIUM: Reflected DOM-Based Cross-Site Scripting via url Parameter (up to 2.0.7.2). WF-d694491c-c0f5-4418-805a-db792ea4f712-39, https://www.wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=api-prod
- 2026-03-16 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (up to 2.1.3). CVE-2026-32462, https://www.wordfence.com/threat-intel/vulnerabilities/id/7a8c28d9-f290-4b08-b48c-beb560c63d2f?source=api-prod
- 2026-02-19 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text' (up to 2.1.1). CVE-2026-2486, https://www.wordfence.com/threat-intel/vulnerabilities/id/a78c2621-afff-40b4-ae45-831b2b847756?source=api-prod
- 2025-12-31 MEDIUM: Unauthenticated Insecure Direct Object Reference (up to 2.0.9.9.4). CVE-2025-63053, https://www.wordfence.com/threat-intel/vulnerabilities/id/2ac09e78-fea1-478f-a3bc-40742bdc0f6a?source=api-prod
- 2025-12-05 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 2.0.9.9.3). CVE-2025-63055, https://www.wordfence.com/threat-intel/vulnerabilities/id/a49ba7e1-ef85-43d6-8685-4cb4e6b7208e?source=api-prod
- 2025-08-11 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox (up to 2.0.9.0). CVE-2025-8874, https://www.wordfence.com/threat-intel/vulnerabilities/id/44e4fb1b-eed4-4ef9-9856-7c5095117aa7?source=api-prod
- 2025-07-15 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 2.0.8.2). CVE-2025-5284, https://www.wordfence.com/threat-intel/vulnerabilities/id/0e1982bd-3ea8-48cd-8b89-39910567525c?source=api-prod
- 2025-03-03 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (up to 2.0.7.2). CVE-2024-9618, https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d399f3-5517-4c5d-b792-94eb8b0cc0f4?source=api-prod
- 2025-03-03 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (up to 2.0.7.1). CVE-2025-0433, https://www.wordfence.com/threat-intel/vulnerabilities/id/c693831f-fe60-4548-83aa-4ebd03d134ec?source=api-prod
- 2025-01-06 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip Module (up to 2.0.6.7). CVE-2024-9502, https://www.wordfence.com/threat-intel/vulnerabilities/id/485c9ee6-9cb5-45ca-86af-ee5d10ee6734?source=api-prod
- 2024-11-11 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (up to 2.0.9.9.4). CVE-2024-52387, https://www.wordfence.com/threat-intel/vulnerabilities/id/c94e321e-69d9-40c5-8242-8d090ba604d1?source=api-prod
- 2024-09-09 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via data-jltma-wrapper-link Element (up to 2.0.6.4). CVE-2024-6282, https://www.wordfence.com/threat-intel/vulnerabilities/id/8bab0acc-5a5d-4dd4-9201-199b7f5aaa69?source=api-prod
- 2024-07-11 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (up to 2.0.6.2). CVE-2024-38710, https://www.wordfence.com/threat-intel/vulnerabilities/id/c02a9639-525c-4e63-8ca0-2452667bbfd5?source=api-prod
- 2024-06-08 MEDIUM: Injection (up to 2.0.5.9). CVE-2024-35688, https://patchstack.com/database/vulnerability/master-addons/wordpress-master-addons-for-elementor-plugin-2-0-5-9-cross-site-scripting-xss-vulnerability?_s_id=cve
- 2024-06-08 MEDIUM: Injection (up to 2.0.6.0). CVE-2024-35702, https://patchstack.com/database/vulnerability/master-addons/wordpress-master-addons-for-elementor-plugin-2-0-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
- 2024-06-06 HIGH: Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Navigation Menu Widget (up to 2.0.6.1). CVE-2024-5542, https://www.wordfence.com/threat-intel/vulnerabilities/id/5151f429-b1f3-43d4-94cf-3ff382b80190?source=api-prod
- 2024-06-06 MEDIUM: Missing Authorization to MA Template Creation or Modification (up to 2.0.6.1). CVE-2024-5382, https://www.wordfence.com/threat-intel/vulnerabilities/id/e3820f80-9b80-4672-b2ff-3864793d2de2?source=api-prod
- 2024-06-03 MEDIUM: Missing Authorization via get_jltma_save_menuitem_settings() (up to 2.0.5.4.1). CVE-2024-35660, https://www.wordfence.com/threat-intel/vulnerabilities/id/88b2d8e6-d242-4943-a121-23898a8fde55?source=api-prod
- 2024-05-16 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 2.0.6.0). CVE-2024-3134, https://www.wordfence.com/threat-intel/vulnerabilities/id/6106c972-5475-4c19-8630-3a01edc616ad?source=api-prod
- 2024-05-15 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 2.0.6.0). CVE-2024-4580, https://www.wordfence.com/threat-intel/vulnerabilities/id/e3e3ac84-dd82-42b0-80b9-c876731170d5?source=api-prod
- 2024-04-29 MEDIUM: Contributor+ Stored Cross-Site Scripting (up to 2.0.5.9). CVE-2024-4265, https://www.wordfence.com/threat-intel/vulnerabilities/id/a9a48769-94d9-459f-b34b-fdfe4c10b36c?source=api-prod
- 2024-04-25 MEDIUM: Missing Authorization on Duplicate Post (up to 2.0.5.4.1). CVE-2024-33595, https://www.wordfence.com/threat-intel/vulnerabilities/id/8e5c3d74-1240-4501-856f-18a1c6369d1c?source=api-prod
- 2024-03-26 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget (up to 2.0.5.6). CVE-2024-2139, https://www.wordfence.com/threat-intel/vulnerabilities/id/8910b6f0-1bf4-4ac0-93b7-54db7c15392c?source=api-prod
- 2024-03-25 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 2.0.5.4.1). CVE-2024-29911, https://www.wordfence.com/threat-intel/vulnerabilities/id/a362e60d-e4ab-4f19-9e18-5473d8e13d80?source=api-prod
- 2023-10-11 MEDIUM: Authenticated(Contributor+) Stored Cross-Site Scripting (up to 2.0.3). WF-abb7def7-df32-4901-b8ea-068ff1af664b, https://www.wordfence.com/threat-intel/vulnerabilities/id/abb7def7-df32-4901-b8ea-068ff1af664b?source=api-prod
- 2023-08-22 HIGH: Missing Authorization (up to 2.0.5.3). CVE-2023-40679, https://www.wordfence.com/threat-intel/vulnerabilities/id/6150c355-1046-483e-aa8b-463c3752021d?source=api-prod
- 2023-07-18 MEDIUM: Reflected Cross-Site Scripting via fs_request_get (1.0.6 to 2.0.2). WF-5253fe2b-040b-417c-b257-0cb59ee5aa6e-330, https://www.wordfence.com/threat-intel/vulnerabilities/id/5253fe2b-040b-417c-b257-0cb59ee5aa6e?source=api-prod
- 2022-03-04 MEDIUM: Missing Authorization Checks (before 1.8.5). WF-39fb0499-9ab4-4a2f-b0db-ece86bcf4d42-199, https://www.wordfence.com/threat-intel/vulnerabilities/id/39fb0499-9ab4-4a2f-b0db-ece86bcf4d42?source=api-prod
- 2022-02-21 MEDIUM: Reflected Cross-Site Scripting (before 1.8.5). CVE-2022-0327, https://www.wordfence.com/threat-intel/vulnerabilities/id/680b2194-0c5e-4d5c-86d8-4c1e8de378d7?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=master-addons · HTML: https://todaywp.com/plugins/master-addons