CVE-2026-66688: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Ultimate Addons for Elementor = 1.45.2 versions...

PT-2026-68588

Name of the Vulnerable Software and Affected Versions Ultimate Addons for Elementor versions prior to 1.45.3 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. This occurs when the application fails to...

CVE-2026-15787: Improper Neutralization of Input During Web Page Generation

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2025-9703: Undefined Security Weakness

The Ultimate Addons for Elementor Formerly Elementor Header & Footer Builder WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability...

CVE-2025-8488 Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) <= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update

The Ultimate Addons for Elementor Formerly Elementor Header & Footer Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savehfecompatibilityoptioncallback function in all versions up to, and including, 2.4.6. This makes it...

CVE-2025-8488: Missing Authorization

The Ultimate Addons for Elementor Formerly Elementor Header & Footer Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savehfecompatibilityoptioncallback function in all versions up to, and including, 2.4.6. This makes it...

CVE-2021-24271

The “Ultimate Addons for Elementor” WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method...

CVE-2024-37455

Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons for Elementor: from n/a through 1.36.31...

PT-2024-27566

Name of the Vulnerable Software and Affected Versions Brainstorm Force Ultimate Addons for Elementor versions 1.36.31 and earlier Description The issue is related to Improper Privilege Management, allowing Privilege Escalation. Recommendations Update to version 1.36.32 to stay secure...

CVE-2024-37455: Improper Privilege Management

Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons for Elementor: from n/a through 1.36.31...

CVE-2023-50890

Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons for Elementor: from n/a through 1.36.20...

CVE-2023-50890: Improper Privilege Management

Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons for Elementor: from n/a through 1.36.20...

PT-2024-13995

Name of the Vulnerable Software and Affected Versions Brainstorm Force Ultimate Addons for Elementor versions 1.36.20 and earlier Description The issue is related to Improper Privilege Management, allowing Privilege Escalation in Brainstorm Force Ultimate Addons for Elementor. Recommendations For...

CVE-2021-24271

CVE-2021-24271 affects the WordPress plugin Ultimate Addons for Elementor (before 1.30.0). The vulnerability is a stored XSS in several widgets, exploitable by lower-privileged users (e.g., contributors) via a similar method. Connected sources confirm the affected version and context; the advisor...

CVE-2021-24271: Improper Neutralization of Input During Web Page Generation

The “Ultimate Addons for Elementor” WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method...

PT-2021-15811

Name of the Vulnerable Software and Affected Versions Ultimate Addons for Elementor versions prior to 1.30.0 Description The issue concerns stored Cross-Site Scripting XSS that can be exploited by lower-privileged users, such as contributors, through several widgets in the plugin. This is achieve...

CVE-2020-13125

An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled...

CVE-2020-13125

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to a registration bypass issue in versions prior to 1.24.2 . This flaw allows unauthenticated attackers to create new user accounts with the Subscriber role, even when the website's registration feature is disabled. This vulnera...

PT-2020-13342

Name of the Vulnerable Software and Affected Versions Ultimate Addons for Elementor plugin versions prior to 1.24.2 Description An issue in the Ultimate Addons for Elementor plugin allows unauthenticated attackers to create users with the Subscriber role, even when registration is disabled. This...

CVE-2020-13125: Undefined Security Weakness

An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled...