Ultimate Addons for Elementor vulnerabilities | LiveThreat CVE Feed

Product

Ultimate Addons for Elementor

by brainstormforce · last CVE Jul 22, 2026

CVEs

On KEV

8.8

Max CVSS

New 30D

Vulnerabilities14 In the news0 Timeline

Severity mix

Critical 0High 2Medium 12Low 0

Severity

All severities14 Critical0 High2 Medium12 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Ultimate Addons for Elementor to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2020-13125	6.5	2%	May 17	An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126 Affected: before 1.24.2
CVE-2026-15787	6.4	0%	Jul 22	Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes Affected: through 2.9.1
CVE-2024-11230	5.4	0%	Dec 23	Elementor Header & Footer Builder <= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget Affected: through 1.6.46
CVE-2024-10325	5.4	0%	Nov 8	Elementor Header & Footer Builder <= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload Affected: through 1.6.45
CVE-2024-5757	5.4	0%	Jun 13	Elementor Header & Footer Builder <= 1.6.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Title Widget Affected: through 1.6.35
CVE-2024-2618	5.4	0%	May 24	Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 1.6.26
CVE-2024-2619	5.4	0%	May 16	Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Author+) HTML Injection Affected: through 1.6.26
CVE-2024-4634	5.4	0%	May 16	Elementor Header & Footer Builder <= 1.6.28 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 1.6.28
CVE-2024-1237	5.4	1%	Mar 13	Elementor Header & Footer Builder <= 1.6.24 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 1.6.24
CVE-2021-24271	5.4	1%	May 5	The “Ultimate Addons for Elementor” WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as… Affected: before 1.30.0
CVE-2025-8488	4.3	0%	Aug 2	Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) <= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update Affected: through 2.4.6
CVE-2024-10050	4.3	0%	Oct 24	Elementor Header & Footer Builder <= 1.6.43 - Authenticated (Contributor+) Information Disclosure via Shortcode Affected: through 1.6.43