WordPress plugin
Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 14 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High0
- Medium14
- Low0
All Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder vulnerabilities
- Medium5.4Authenticated (Contributor+) Cross-Site Scripting
≤2.9.5Update to 2.9.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes
≤2.9.1Update to 2.9.2
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
≤2.4.9Update to 2.5.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Limited Settings Update
≤2.4.6Update to 2.4.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget
≤1.6.46Update to 1.6.47
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
≤1.6.45Update to 1.6.46
- Medium4.3Authenticated (Contributor+) Information Disclosure via Shortcode
≤1.6.43Update to 1.6.44
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.6.35Update to 1.6.36
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Site Title Widget
≤1.6.35Update to 1.6.36
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.6.26Update to 1.6.26.1
- Medium5.0Authenticated (Author+) HTML Injection
≤1.6.26Update to 1.6.27
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.6.28Update to 1.6.29
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.6.24Update to 1.6.25
- Medium6.4Stored Cross-Site Scripting
<1.5.8Update to 1.5.8
Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder: common questions
Does Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 14 known vulnerabilities in Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder: 14 medium. None are known to affect version null.
How do I check which version of Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder vulnerability?
CVE-2026-39739, published Oct 30, 2026: Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder <= 2.9.5 - Authenticated (Contributor+) Cross-Site Scripting. Severity: Medium (CVSS 5.4).
Is any Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder vulnerability listed in CISA KEV?
No. None of the known Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder vulnerabilities is currently listed in the CISA KEV catalog.