Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits

• Headers & Footers – Fully responsive, with sticky and transparent options
• Single Post & Page templates
• Archive, Category, Tag, Author, Date pages
• 404 Page and Search Results page
• Comment Forms – styled entirely in Elementor
• Display conditions let you assign each template to specific pages, post types, or user roles

• Page Load – with configurable delay
• On Scroll – appears after user scrolls 25%, 50%, 70%, or 90% down the page
• Exit Intent – captures visitors before they leave
• On Click – fires only when a user clicks a specific button or link
• After Inactivity – re-engages idle visitors automatically

• Add controls (text, color, toggles, select dropdowns) from a visual panel
• Auto-generated shortcodes like {{color}} map live editor inputs directly to your code
• Save once and drag the widget onto any page like a native Elementor element

1. In your WordPress dashboard, go to Plugins → Add New and search for “Master Addons”.
2. Click Install Now, then click Activate to enable the plugin.
3. Alternatively, download the master-addons.zip file and upload it via Plugins → Add New → Upload Plugin.
4. You can also install it manually by uploading the extracted master-addons folder to /wp-content/plugins/ via FTP, then activating it from the Plugins screen.

Note: Elementor must be installed and activated before you can use Master Addons.

• Security: Made the Recommended Plugins screen safer so only the plugins we list can be installed or activated.
• Security: Tightened the Mega Menu so it only responds to its own known actions.
• Security: Added safety checks when importing Template Kits to block unsafe files.
• Fixed: Some admin screens (Settings, Template Kits, Template Library, Setup Wizard) could show up blank — they now load correctly.
• Improved: Mega Menu now works smoothly with Elementor's new Atomic Elements, and only loads its styles on the pages that use a Mega Menu — so menus look right everywhere and your pages stay fast.
• Improved: General compatibility and code-quality tidy-up for the WordPress.org review.
• Maintenance: Updated the licensing library and removed unused files.

• Security: moved the Custom CSS editor to the Pro build (no arbitrary CSS insertion in the free plugin).
• Security: added nonce verification to Mega Menu options save.
• Security: added capability checks to popup, template-save, white-label, and rollback handlers.
• Security: whitelisted option-name prefixes in the internal options helper.
• Compliance: renamed short/reserved identifiers to the unique jltma prefix; migrated popup table/option to prefixed names.
• Maintenance: removed unused bundled readme/markdown libraries; dropped a legacy Elementor (< 2.2.8) AJAX hook.

• Added: Timeline widget Title and Content typography and color controls (Cards section), applied to both Post and Custom timeline items.
• Security: Hardened popup list sorting so it only accepts known sort options.
• Security: Tightened permissions on the Mega Menu content editor so only menu managers can use it.
• Improved: Custom CSS and JS in the Widget Builder are now a Pro feature; HTML stays available for everyone.
• Improved: Template previews now open in a new browser tab instead of loading inside the dashboard.
• Improved: Used unique name prefixes across the plugin for better compatibility with other plugins.
• Improved: Updated the Select2 library to the latest stable version.
• Improved: The setup wizard theme image now loads from within the plugin instead of an external site.
• Improved: Review links now open the full reviews page.
• Improved: Timeline date background colors (Default/Hover/Focused) are now a Pro feature.
• Fixed: Template Live Preview link is now easy to read in Elementor's dark mode.
• Fixed: Counter Up icons chosen from the icon library now match the font icons in size, color, and circle shape.
• Fixed: Comments widget no longer triggers a PHP notice when reCAPTCHA keys are not configured.
• Fixed: Domain Checker no longer reports available domains as already taken.
• Fixed: Removed an empty duplicate Patterns section from the Advanced tab (it remains in the Style tab).

• Added: Custom Attributes support for the link/button controls in Creative Button, Creative Links, Dual Heading, Info Box, Business Hours, Flipbox, Advanced Image, Image Hover Effects, Call to Action, Pricing Table and Featured Product (Pro) widgets.
• Added: Countdown Timer style presets (Card, Flip, Circle, Gradient, Neon, Glassmorphism, Minimal, Outline, Neumorphic) with the Layout and Style Preset options separated; the new presets are gated to Pro.
• Added: Counter Up responsive column support and a Content Position control for placing the title around the number.
• Added: Changelog widget Style tab controls (Heading, Title, Content) so the Style tab now appears before Advanced.
• Added: Pricing Table individual Currency, Fractional and Period color controls.
• Fixed: Dual Heading link showed "[object Object]" as the href in the editor and ignored Open in new window / Add nofollow / Custom Attributes; Style 1 markup, heading structure and extra-span spacing corrected.
• Fixed: Tooltip Width, Background, Color, Padding, Border and Typography style controls now apply (scoped to the per-widget Tippy theme); Tooltip Text now updates live in the Elementor editor.
• Fixed: Gradient Headline hover gradient colors now apply on hover only when set.
• Fixed: Pricing Table price typography now targets the price amount only, and extra spacing around the price/currency is removed.
• Fixed: Image Hover Effects border radius now rounds the image, border and hover overlays.
• Fixed: Progress Bar percentage number typography/DOM controller styling.
• Fixed: Contact Form 7 label margin now applies to the form labels.
• Fixed: "Unregistered dependency" PHP notice (jltma-prism) for the Source Code widget when the Pro license is inactive.
• Fixed: Nonce issue fixed.
• Added: Widget Builder now lets you add conditions and loops in your widget code, so you can show or hide parts of a widget and repeat items based on your settings.
• Added: Documentation links inside the Widget Builder — a quick link in the code panel and a help icon on every control.
• Improved: A roomier Widget Builder code editor — a wider editing area, a draggable panel you can size yourself, and cleaner, thinner scrollbars.
• Improved: Premium controls are now clearly locked on the free version and can no longer be added by mistake.
• Fixed: Background, typography and text shadow styling now applies exactly where you choose instead of to the whole widget.
• Fixed: Importing a widget now opens it correctly, and the Widget Builder menu appears in the right place.
• Improved: Widgets you build are now shown in a safer, more reliable way.

• Security: Widget Builder no longer accepts or executes arbitrary PHP. PHP tags are stripped from all widget HTML/CSS/JS on save and during generation, so generated widget files contain only plugin-authored code. Dynamic values use {{placeholders}} that are escaped on output.
• Security: Removed the Widget Builder preview path that wrote user code to a temporary PHP file and included it. Previews now render statically with escaped mock values — no user PHP or JavaScript is executed.
• Security: Fixed an authenticated (author+) Stored XSS via the 'jtlma_custom_js' page setting / 'custom_js' element setting of the Custom JS extension (reported in versions up to 3.1.0). The extension is removed from the free plugin entirely (no render path remains); in Master Addons Pro the unfiltered_html capability is now enforced on save (the value is stripped for unprivileged users via the elementor/document/save filter) and at render (output gated by the post author's capability), not only during control registration.
• Security: Hardened the Custom CSS extension against tag-breakout XSS. The 'custom_css' element setting is now sanitized on save (via the elementor/document/save filter) and again on render before it is added to the stylesheet, stripping HTML/PHP tags (e.g. a "" breakout), expression(), @import and javascript:/behavior: — closing the same direct-AJAX save bypass.
• Security: Added a nonce check to the Content Restriction AJAX handler and a capability check to the popup shortcode and template plugin-status AJAX handlers.
• Security: Sanitized the Select2 REST nonce flow (fail-closed) and tightened its capability to edit_posts; sanitized the template-data request and template-kit theme-activation nonce.
• Security: The bundled Markdown library no longer hooks the_content/comment filters globally; the jltma_template shortcode now escapes its returned markup.
• Maintenance: Updated @popperjs/core from 2.9.3 to 2.11.8. Removed the legacy option-based Widget Builder. Existing custom widgets are migrated automatically (data scrubbed and files regenerated; no widgets are deleted).

• Compliance: Documented every external service the plugin contacts (Master Addons template API, Pixar Labs API, Google reCAPTCHA, Twitter/X, WhatsApp, Freemius) with terms and privacy links.
• Compliance: Removed the Template Kit "fix compatibility" routine that rewrote the active_plugins option.
• Compliance: Replaced deprecated openssl_free_key() and get_page_by_title() with version-safe equivalents.
• Compliance: Widget Builder preview now uses an included temporary file.
• Compliance: Replaced the PHP short tag in the Infobox widget and removed remote CDN dependencies (Font Awesome, ace-builds, placeholder images now load locally / from Elementor).
• Compliance: Replaced remote file_get_contents() calls with the WordPress HTTP API and moved generated Widget Builder files to the uploads directory.
• Compliance: Removed the front-end PHP session in the Popup Builder in favour of a cookie.
• Compliance: Standardised every gettext call on the "master-addons" text domain and added direct-file-access protection to entry-point files.
• Added: Popup Builder now rejects duplicate display conditions and shows an inline validation message.
• Improved: Theme Builder condition validation messages are shown as a centered, colour-coded alert.
• Fixed: "Undefined array key" PHP warnings in the upgrade notice and Pro upgrade dashboard widget.
• Fixed: Renamed an asset file containing a space and removed hidden system files.

• Added: Dynamic Table Addons table head show/hide option add.
• Fixed: Dynamic Table mobile view warning issue fixed.

• Fixed: Nav Menu hamburger toggle not working on mobile devices.
• Fixed: Nav Menu offcanvas, popup, and default dropdown modes styling restored after Bootstrap dependency removal.
• Fixed: Pro plugin showing "Sorry, you are not allowed to access this page." when Master Addons Free is not installed - now shows a proper install-free notice.
• Fixed: Console errors across the Template Library after SweetAlert removal (delete kit, template import, plugin install/activate).
• Fixed: Template Kit card thumbnail click now opens the in-app kit details view instead of opening an external preview URL.
• Added: Redesigned Template Kit upload flow with a single continuous modal — inline confirmation, stepped progress, per-template filename display, no popup-over-popup.
• Added: Faster Template Kit extraction using native ZipArchive with raised memory and execution time limits.
• Added: "IMPORTED" badge on Template Kit cards already present in the local library.
• Added: Shared promise-based confirmation and alert dialog system usable across Template Library, Widget Builder, Popup Builder, and Theme Builder.
• Added: ARIA attributes and keyboard accessibility (Enter / Space / Esc) to Nav Menu toggle and import modals.
• Added: Template Kits, Library & Popup Builder help tutorials links added.

• Fixed: Gallery Slider Thumbnails style issue fixed.
• Added: Some missing help links add to options settings.

• Fixed: Elementor Custom Icon Library not showing issue fixed.

• Fixed: Fatal error in RegistrationMagic plugin resolved.

• Fixed: Gallery Slider swiper slide issue fixed.
• Fixed: Gallery Slider lightbox features frontend image infinite loading issue fixed. Full Changelog →