CVE-2024-9618 – This stored XSS vulnerability in the Master Add... (How to Fix)

Q: What is the severity of CVE-2024-9618?

CVE-2024-9618 has a CVSS score of 6.4 (MEDIUM). This stored XSS vulnerability in the Master Addons WordPress plugin allows authenticated attackers with contributor-level access or higher to inject malicious scripts into website pages. The scripts execute whenever users visit compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using Master Addons plugin versions up to 2.0.7.2 are affected.

📋 TL;DR

This stored XSS vulnerability in the Master Addons WordPress plugin allows authenticated attackers with contributor-level access or higher to inject malicious scripts into website pages. The scripts execute whenever users visit compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using Master Addons plugin versions up to 2.0.7.2 are affected.

💻 Affected Systems

Products:

Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations

Versions: All versions up to and including 2.0.7.2

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress with Elementor and Master Addons plugin installed. Contributor-level access or higher needed for exploitation.

📦 What is this software?

Master Addons by Master Addons

View all CVEs affecting Master Addons →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or perform actions as authenticated users, potentially leading to complete site compromise.

🟠

Likely Case

Attackers with contributor access inject malicious scripts that steal user session cookies or credentials when visitors view compromised pages.

🟢

If Mitigated

With proper user access controls and content security policies, impact is limited to potential defacement of specific pages without credential theft.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is technically simple once attacker has contributor-level credentials.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.0.7.3 or later

Vendor Advisory: https://master-addons.com/changelogs/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Master Addons plugin. 4. Click 'Update Now' if update available. 5. Alternatively, download latest version from WordPress repository and replace plugin files.

🔧 Temporary Workarounds

Restrict User Roles

all

Limit contributor-level access to trusted users only and implement principle of least privilege.

Implement Content Security Policy

all

Add CSP headers to restrict script execution sources and mitigate XSS impact.

Add to .htaccess: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
Or add to wp-config.php: header("Content-Security-Policy: default-src 'self'; script-src 'self'");

🧯 If You Can't Patch

Disable Master Addons plugin completely until patched
Remove contributor access for all untrusted users and audit existing contributor accounts

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins → Master Addons version. If version is 2.0.7.2 or lower, system is vulnerable.

Check Version:

wp plugin list --name=master-addons --field=version (if WP-CLI installed)

Verify Fix Applied:

After update, verify Master Addons plugin version shows 2.0.7.3 or higher in WordPress plugins list.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to WordPress admin-ajax.php or admin-post.php with Master Addons parameters
Multiple page edits by contributor-level users in short time
Script tags containing unusual attributes in page content

Network Indicators:

Outbound connections to suspicious domains from WordPress pages
Unexpected script loads from non-standard sources

SIEM Query:

source="wordpress.log" AND ("master-addons" OR "jltma_") AND (POST OR PUT) AND status=200

📊 Metadata

CVE ID: CVE-2024-9618

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

EPSS Score: 0.25% exploit probability (47.5th percentile)

Published: March 4, 2025

Last Updated: March 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-9618, you might also want to check these: