GCVE - cpe:2.3:a:unknown:master_addons_for

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:master_addons_for_elementor:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Master Addons For Elementor (`acac07b1-b2c2-53ac-9fde-8dfa1b8f7b89`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-91015`	vulnerable	2026-10-13 12:28:43.603522	Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup on the site. Published: 2026-09-17T06:00:13.592Z Updated: 2026-09-17T12:25:38.140Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/e052c684-7b82-4555-8bf7-600b894264db/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-0327`	vulnerable	2026-06-08 05:39:09.730541	Master Addons for Elementor < 1.8.2 - Reflected Cross-Site Scripting The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX action, available to unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting Published: 2022-03-14T14:41:29.000Z Updated: 2024-08-02T23:25:40.050Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/df38cc99-da3c-4cc0-b179-1e52e841b883	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.