Stored Cross-Site Scripting Vulnerability in Master Addons for Elementor by WordPress
CVE-2025-5284
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 16 July 2025
What is CVE-2025-5284?
The Master Addons plugin for WordPress, specifically the Custom JS extension, is susceptible to Stored Cross-Site Scripting. This vulnerability arises from inadequate capability restrictions and poor input sanitization and output escaping. Authenticated attackers with Contributor-level access can exploit this weakness to inject arbitrary scripts into pages. Such scripts are executed when users visit the compromised pages, potentially leading to serious security breaches.
Affected Version(s)
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations * <= 2.0.8.2