Ultimate Addons For Elementor
Vendor:
First CVE: May 17, 2020 · Active for 6 years
14
Total CVEs
More Total CVEs than 92% of tracked products
2.8
Avg CVEs / Year
Higher CVE frequency than 78% of tracked products
5.9
Avg CVSS
Higher Avg CVSS than 22% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Ultimate Addons For Elementor over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 17, 2020
6 years ago
Most Recent CVE
Jul 22, 2026
5 days ago
CVE Severity & Scoring
Ultimate Addons For Elementor14 CVEs
86%
14%
All CVEs352,785 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network14 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low14 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None6 (42.9%)
Unknown0 (0.0%)
Required8 (57.1%)
Privileges Required
Low13 (92.9%)
High0 (0.0%)
None1 (7.1%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (14 CVEs).
14 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-15787MEDIUM The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all ve | Jul 22, 2026 | 6.4 | 30 | NO | NO |
CVE-2020-13125MEDIUM An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthen | May 17, 2020 | 6.5 | 28 | NO | YES |
CVE-2024-37455HIGH Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons for Elementor: from n/a | Jul 9, 2024 | 8.8 | 24 | NO | NO |
CVE-2023-50890HIGH Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons for Elementor: from n/a | May 17, 2024 | 8.8 | 24 | NO | NO |
CVE-2021-24271MEDIUM The “Ultimate Addons for Elementor” WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as co | May 5, 2021 | 5.4 | 19 | NO | NO |
CVE-2024-11230MEDIUM The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up to, and including, 1.6.46 due to | Dec 23, 2024 | 5.4 | 18 | NO | NO |
CVE-2024-1237MEDIUM The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the flyout_layout attribute in all versions up to, and including, 1.6.24 | Mar 13, 2024 | 5.4 | 18 | NO | NO |
CVE-2024-10325MEDIUM The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.6.45 d | Nov 8, 2024 | 5.4 | 17 | NO | NO |
CVE-2024-10050MEDIUM The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 1.6.43 via the hfe_template shortcode. This | Oct 24, 2024 | 4.3 | 17 | NO | NO |
CVE-2024-2618MEDIUM The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the size attribute in all versions up to, and including, 1.6.26 due to i | May 24, 2024 | 5.4 | 17 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (14 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
7.1% of CVEs· 97th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (14 CVEs).
Media Mentions
Signals from CVEs in this product scope (14 CVEs).
Top CNAs Publishing CVEs For Ultimate Addons For Elementor
Top CWEs
Versions
No cataloged versions.