Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the server.auth.URL function. An attacker can obtain authentication tokens and circumvent access controls by supplying a crafted realm value in the WWW-Authenticate header returned from the /api/pull endpoint...

Dependency on Vulnerable Third-Party Component

Overview Affected versions of this package are vulnerable to Dependency on Vulnerable Third-Party Component via the bnmpgrow function. An attacker can cause unexpected behavior or potentially execute arbitrary code by providing specially crafted input that triggers an integer overflow in the...

CVE-2025-5284 Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS extension in all versions up to, and including, 2.0.8.2 due to insufficient capability restriction, and...

CVE-2025-5284 Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS extension in all versions up to, and including, 2.0.8.2 due to insufficient capability restriction, and...

CVE-2025-5284

CVE-2025-5284 affects the WordPress plugin “Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations.” It describes a Stored Cross-Site Scripting (XSS) vulnerability via the Custom JS extension in all versions up to and including 2.0.8.2, caused by ...

WordPress plugin Master Addons 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2025-29715 · WordPress · The Master Addons – Elementor Addons

Name of the Vulnerable Software and Affected Versions: Master Addons – Elementor Addons versions prior to 2.0.8.3 Description: The Master Addons – Elementor Addons plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Custom JS extension. Insufficient capability...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the Glyph rendering process. An attacker can execute arbitrary code or cause a denial of service by supplying specially crafted input to the affected rendering functionality. Details Serialization i...

Misinterpretation of Input

Overview Affected versions of this package are vulnerable to Misinterpretation of Input in the Optimizer component. An attacker can cause the application to crash repeatedly and become unresponsive by supplying specially crafted input. Details Denial of Service DoS describes a family of attacks,...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the InnoDB component. An attacker can cause the server to hang or crash repeatedly by sending crafted requests over the network with high privileges. Details Denial of Service DoS describes a family of attacks,...

Misinterpretation of Input

Overview Affected versions of this package are vulnerable to Misinterpretation of Input in the InnoDB component. An attacker can cause the application to become unresponsive or crash repeatedly by sending specially crafted requests. Details Denial of Service DoS describes a family of attacks, all...

Misinterpretation of Input

Overview Affected versions of this package are vulnerable to Misinterpretation of Input in the InnoDB component. A privileged attacker can cause the application to become unresponsive or crash repeatedly by sending specially crafted requests. Remediation A fix was pushed into the master branch bu...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the DDL component. An attacker can cause the server to hang or crash repeatedly by sending crafted requests over the network with high privileges. Details Denial of Service DoS describes a family of attacks, al...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through InnoDB component. An attacker can cause a denial of service by sending specially crafted requests to the affected database instance. Details Denial of Service DoS describes a family of attacks, all aimed at...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the Components Services process. An attacker can cause the server to hang or crash repeatedly by sending specially crafted requests over the network while authenticated with high privileges. Details Denial of...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the Optimizer component. An attacker can cause the server to hang or crash repeatedly by sending specially crafted requests over the network. Details Denial of Service DoS describes a family of attacks, all aim...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the Optimizer component. An attacker can cause the server to hang or crash repeatedly by sending specially crafted requests over the network. Details Denial of Service DoS describes a family of attacks, all aim...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the Stored Procedure component. An attacker can cause the server to hang or crash repeatedly by sending crafted requests over the network with high privileges. Details Denial of Service DoS describes a family o...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the mysqldump component. An attacker can gain unauthorized access to read and modify certain data by leveraging network access and requiring interaction from another user. Remediation A fix was pushed into the...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the InnoDB component. An attacker can cause the server to hang or crash repeatedly by sending crafted requests over the network with high privileges. Details Denial of Service DoS describes a family of attacks,...