Medium severity6.4NVD Advisory· Published May 2, 2024· Updated Apr 8, 2026
CVE-2024-4265
CVE-2024-4265
Description
The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, and including, 2.0.5.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-35688 is likely a duplicate of this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- cpe:2.3:a:master-addons:master_addons:*:*:*:*:*:wordpress:*:*Range: <2.0.6.0
- Range: <=2.0.5.9
Patches
Vulnerability mechanics
References
4- plugins.trac.wordpress.org/changeset/3078134/nvdPatch
- www.wordfence.com/threat-intel/vulnerabilities/id/a9a48769-94d9-459f-b34b-fdfe4c10b36cnvdThird Party Advisory
- plugins.trac.wordpress.org/browser/master-addons/trunk/addons/ma-image-carousel/ma-image-carousel.phpnvdProduct
- plugins.trac.wordpress.org/browser/master-addons/trunk/addons/ma-logo-slider/ma-logo-slider.phpnvdProduct
News mentions
0No linked articles in our index yet.