Ultimate addons for elementor

This hub aggregates every CVE we track for Ultimate addons for elementor, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Ultimate addons for elementor.

• CVE-2026-66688WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability6.5Aug 6, 2026
• CVE-2026-15787Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes6.4Jul 22, 2026
• CVE-2025-8488Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) <= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update4.3Aug 2, 2025
• CVE-2024-11230Elementor Header & Footer Builder <= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget6.4Dec 23, 2024
• CVE-2024-10325Elementor Header & Footer Builder <= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4Nov 8, 2024
• CVE-2024-10050Elementor Header & Footer Builder <= 1.6.43 - Authenticated (Contributor+) Information Disclosure via Shortcode4.3Oct 24, 2024
• CVE-2024-37455WordPress Ultimate Addons for elementor plugin <= 1.36.31 - Privilege Escalation vulnerability8.8Jul 9, 2024
• CVE-2024-5757Elementor Header & Footer Builder <= 1.6.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Title Widget6.4Jun 13, 2024
• CVE-2024-2618Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4May 24, 2024
• CVE-2023-50890WordPress Ultimate Addons for Elementor plugin <= 1.36.20 - Privilege Escalation vulnerability8.8May 17, 2024
• CVE-2024-2619Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Author+) HTML Injection5.0May 16, 2024
• CVE-2024-4634Elementor Header & Footer Builder <= 1.6.28 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4May 16, 2024
• CVE-2024-1237Elementor Header & Footer Builder <= 1.6.24 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4Mar 13, 2024
• CVE-2021-24271Ultimate Addons for Elementor < 1.30.0 - Contributor+ Stored XSS5.4May 5, 2021
• CVE-2020-13125An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers...6.5May 17, 2020