--- title: "Ultimate Addons for Elementor vulnerabilities since 2021" description: "The 13 vulnerabilities in the free Ultimate Addons for Elementor plugin, the fixed versions and the 2020 attack exploiting its premium version." language: "en" locale: "en-US" type: "article" canonical: "https://www.wp-masquerade.com/ultimate-addons-elementor-security-vulnerabilities/" published: "2026-07-29T07:00:00+00:00" modified: "2026-10-29T07:36:33+00:00" translations: en-US: "https://www.wp-masquerade.com/ultimate-addons-elementor-security-vulnerabilities/index.md" fr-FR: "https://www.wp-masquerade.com/fr/failles-securite-ultimate-addons-elementor/index.md" es-ES: "https://www.wp-masquerade.com/es/vulnerabilidades-ultimate-addons-elementor/index.md" de-DE: "https://www.wp-masquerade.com/de/ultimate-addons-elementor-sicherheitsluecken/index.md" it-IT: "https://www.wp-masquerade.com/it/vulnerabilita-sicurezza-ultimate-addons-elementor/index.md" pt-BR: "https://www.wp-masquerade.com/pt/vulnerabilidades-seguranca-ultimate-addons-elementor/index.md" nl-NL: "https://www.wp-masquerade.com/nl/ultimate-addons-elementor-kwetsbaarheden-beveiliging/index.md" --- # Ultimate Addons for Elementor vulnerabilities since 2021 Thirteen medium-severity vulnerabilities in Brainstorm Force's free plugin since 2021, and a 2020 attack that targeted its premium version: timeline, fixed versions and protections. Thirteen vulnerabilities published since 2021 for Brainstorm Force's free plugin, all of medium severity, and a famous 2020 attack that actually targeted its paid big sister. This article puts each vulnerability in its proper place, gives the fixed versions and timelines, then details the settings that limit the risk on a site built with Elementor. ## Ultimate Addons for Elementor in brief On wordpress.org, the plugin uses the slug `header-footer-elementor`, a legacy of its first name: Elementor Header & Footer Builder. Released in March 2017, it was first used to build a theme's header and footer with the Elementor editor, then gained widgets (navigation menu, page title, site title, breadcrumbs, WooCommerce product grid…). With version 2.0.0, released on November 29, 2024, it was renamed Ultimate Addons for Elementor (UAE): the vendor now presents it as the free version of its lineup. It has more than 2 million active installations (wordpress.org). The name creates a confusion that needs clearing up from the start. Brainstorm Force has also sold, for years, a premium plugin called Ultimate Addons for Elementor, distributed outside wordpress.org and tracked separately in vulnerability databases (slug `ultimate-elementor` at Wordfence). The two products share a name and a vendor, not their code. A vulnerability in one does not automatically affect the other. What makes it a target is simple: the plugin adds to Elementor, present on millions of sites, and its widgets appear in the header and footer, and therefore on every page. A script injected into the navigation menu runs for every visitor, including the logged-in administrator. For the history of Elementor itself, see [our timeline of Elementor vulnerabilities](https://www.wp-masquerade.com/elementor-security-vulnerabilities/). ## Timeline of vulnerabilities from 2020 to July 2026 ![Timeline: May 6, 2020, forced registration in the premium version, exploited together with Elementor Pro; April 13, 2021, contributor XSS fixed in 1.5.8; March 11, 2024, menu widget XSS fixed in 1.6.25; May 2024, three vulnerabilities fixed in 1.6.27 and 1.6.29; June and July 2024, two XSS fixed in 1.6.36; October 23, 2024, drafts readable via the hfe_template shortcode, fixed in 1.6.44; November 29, 2024, renamed Ultimate Addons for Elementor; August 1, 2025, setting changeable by a subscriber, fixed in 2.4.7; September 15, 2025, XSS via SVG file fixed in 2.5.0; July 21, 2026, menu widget XSS fixed in 2.9.2.](https://www.wp-masquerade.com/media/2026/10/chronologie-failles-ultimate-addons-elementor-en.webp) *Dates are those of each vulnerability's publication. Only the 2020 event concerns the premium version.* The table below lists the free plugin's vulnerabilities published from January 1, 2020 to July 26, 2026, based on the WPScan list, cross-checked against Patchstack and the [CVE](https://www.wp-masquerade.com/glossary/cve/) records. The [CVSS score](https://www.wp-masquerade.com/glossary/cvss/) is the one from the authority that assigned the CVE (Wordfence, unless stated otherwise). None of these vulnerabilities is documented as exploited. | Published | Fixed in | Type | CVSS | CVE | Account required | | --- | --- | --- | --- | --- | --- | | April 13, 2021 | 1.5.8 | Stored XSS (Page Title and Site Title widgets) | 5.4 (NVD) | CVE-2021-24256 | Contributor | | March 11, 2024 | 1.6.25 | Stored XSS (navigation menu) | 6.4 | CVE-2024-1237 | Contributor | | May 15, 2024 | 1.6.29 | Stored XSS (hfe_svg_mime_types function) | 6.4 | CVE-2024-4634 | Contributor | | May 16, 2024 | 1.6.27 | HTML injection | 5.0 | CVE-2024-2619 | Author | | May 23, 2024 | 1.6.27 | Stored XSS (size attribute) | 6.4 | CVE-2024-2618 | Contributor | | June 12, 2024 | 1.6.36 | Stored XSS (Site Title widget) | 6.4 | CVE-2024-5757 | Contributor | | July 1, 2024 | 1.6.36 | DOM-based XSS | 6.5 (Patchstack) | CVE-2024-33933 | Contributor | | October 23, 2024 | 1.6.44 | Private content disclosure (shortcode) | 4.3 | CVE-2024-10050 | Contributor | | November 7, 2024 | 1.6.46 | Stored XSS via SVG file upload | 6.4 | CVE-2024-10325 | Author | | December 22, 2024 | 1.6.47 | Stored XSS (Page Title widget) | 6.4 | CVE-2024-11230 | Contributor | | August 1, 2025 | 2.4.7 | Missing authorization (compatibility setting) | 4.3 | CVE-2025-8488 | Subscriber | | September 15, 2025 | 2.5.0 | Stored XSS via SVG file uploaded through xmlrpc.php | 6.8 (WPScan) | CVE-2025-9703 | Author | | July 21, 2026 | 2.9.2 | Stored XSS (navigation menu icons) | 6.4 | CVE-2026-15787 | Contributor | *Free header-footer-elementor plugin: 13 vulnerabilities published between 2020 and July 26, 2026 (sources: WPScan, Patchstack, NVD, Wordfence).* A version detail: for CVE-2024-2618, WPScan states a fix in "1.6.26.1", a version that does not appear in the list published on wordpress.org; the first version released after 1.6.26 is 1.6.27, from April 15, 2024. ## The notable vulnerabilities explained ### May 2020: the combined attack that targeted the premium version On May 6, 2020, the Wordfence Threat Intelligence team received reports of ongoing attacks against two paid plugins: Elementor Pro and Ultimate Addons for Elementor, Brainstorm Force's premium version. Wordfence then estimated Elementor Pro was on more than a million sites and premium Ultimate Addons on about 110,000. The two vulnerabilities fit together. In premium Ultimate Addons before 1.24.2 (CVE-2020-13125, CVSS 7.2 according to the MITRE record, 6.5 according to NVD), a visitor who was not logged in could create a subscriber account even if registration was closed on the site. In Elementor Pro before 2.9.4 (CVE-2020-13126, CVSS 9.9), a mere subscriber could upload an executable file to the server, and therefore run code on it. The attackers created the account with the first vulnerability, then dropped a [backdoor](https://www.wp-masquerade.com/glossary/backdoor/) with the second. Elementor released Elementor Pro 2.9.4 on May 7, 2020; Brainstorm Force fixed its premium version in 1.24.2. Wordfence recommended looking for unknown subscribers, files named `wp-xmlrpc.php` and unexpected files in `/wp-content/uploads/elementor/custom-icons/`. The free plugin, then called Elementor Header & Footer Builder, was not affected: no database links it to this campaign. If you read "Ultimate Addons for Elementor exploited in 2020", it refers to the paid product. ### 2021: the Elementor ecosystem's widgets under scrutiny In April 2021, Wordfence published a series of vulnerabilities affecting more than 15 Elementor add-on plugins, installed in total on more than 3.5 million sites. The pattern was the same everywhere: the Elementor editor is open to contributors, and the widgets trusted the settings they received. In Elementor Header & Footer Builder, the Page Title widget accepted an HTML tag parameter that was supposed to be chosen from a fixed list; by forging the save request, a contributor could replace it with `script` and have their code run every time the page was displayed (CVE-2021-24256). Version 1.5.8, released on March 31, 2021, had fixed the problem before the vulnerability was published in the databases on April 13. ### 2024: nine vulnerabilities in one year 2024 accounts for nine of the thirteen vulnerabilities. Seven are XSS: a contributor or author slips JavaScript into a widget attribute (the menu's `flyout_layout`, the titles' `size`, the Site Title widget's URL) or into an SVG file, and that code runs in every visitor's browser. If the victim is an administrator, the script can act with their rights, for example to create an account. Our article on XSS vulnerabilities in WordPress details this mechanism. The October vulnerability is of another type. The `[hfe_template]` shortcode displayed the content of a template from its ID without checking its status: a contributor could read drafts, private or password-protected content that did not belong to them (CVE-2024-10050). The changelog for versions 1.6.44 and 1.6.46 thanks Wordfence and researcher Francesco Carlucci; the one for 1.6.47 thanks Wordfence. As for timelines, the publication dates of the archives on wordpress.org show that the fixes almost always came out before the public announcement: 1.6.25 on February 13, 2024 for a vulnerability published on March 11, 1.6.29 on May 14 for a publication on May 15, 1.6.44 on October 22 for October 23, 1.6.47 on November 22 for December 22. This is how coordinated disclosure normally works: the researcher notifies the vendor, who fixes the issue, and then the vulnerability is made public. ### 2025: a subscriber and an SVG file CVE-2025-8488 is the only vulnerability open to a mere subscriber: the function that saves the theme compatibility option did not check the user's permissions. The impact is limited to that setting (CVSS 4.3). Version 2.4.7, released on July 31, 2025, thanks Peter Thaleikis; the vulnerability was published on August 1. CVE-2025-9703, published by WPScan on September 15, 2025, shows that a protection can be bypassed through another door: SVG sanitization did not apply to files sent through `xmlrpc.php`, encoded in base64. An author could thus drop a booby-trapped SVG at a predictable address. The fix came with 2.5.0, on September 12, 2025. ### July 2026: the navigation menu, again The last vulnerability published before this article was written (CVE-2026-15787, July 21, 2026) affects the menu widget's `data-toggle-icon` and `data-close-icon` attributes. The WordPress filter applied to users without full HTML rights let encoded HTML entities through in these attributes; the browser decoded them, then the widget's script inserted them as code. Version 2.9.2 of July 20, 2026 fixes the problem and thanks Asaf Mozes (WPScan). All versions up to 2.9.1 are affected: check yours. ![Bar chart of the number of vulnerabilities published per year for the free plugin, according to WPScan: 0 in 2020, 1 in 2021, 0 in 2022 and 2023, 9 in 2024, 2 in 2025 and 1 in 2026 up to July 26, all of medium severity.](https://www.wp-masquerade.com/media/2026/10/failles-par-annee-ultimate-addons-elementor-en.webp) *WPScan database, January 1, 2020 to July 26, 2026; the 2020 premium vulnerability is not counted.* ## What this history shows - **One dominant family of vulnerabilities**: ten of the thirteen are stored XSS, almost always in a widget. Every new widget adds attributes to filter, and the same widgets (navigation menu, Page Title) come up several times. - **Always an account required**: no vulnerability in the free plugin is exploitable by an anonymous visitor. The risk therefore depends on who can log in: a site without outside contributors is much less exposed than an open editorial site. - **Fast fixes**: where the dates are known, the fixed version was available before or at the time of the public announcement. - **The name is not enough**: the 2020 attack shows that you need to check the exact product and version before raising the alarm, or relaxing. This profile is better than that of other Elementor add-ons: Essential Addons for Elementor had a critical unauthenticated vulnerability in 2023, which we cover in our article on CVE-2023-32243. And as [the timeline of WordPress core security releases](https://www.wp-masquerade.com/wordpress-core-vulnerabilities-timeline/) shows, no software escapes regular fixes. ## Protecting your site - **Update**: aim for at least 2.9.2 for the free plugin. If you also use the premium version, update it from your Brainstorm Force account: it does not go through wordpress.org. - **Turn on automatic updates** for the plugin, at least for patch releases; our guide to automatic plugin updates explains how to limit the risk of breakage. - **Limit roles**: most of these vulnerabilities require a contributor or author account. Only give these roles to people who need them, close public registration if it is not used and delete inactive accounts (see roles and least privilege). - **Turn off what you do not use**: since version 2.4.2 the plugin lets you disable unused widgets, and an unnecessary plugin should be deleted (see abandoned and unnecessary plugins). - **Add a web application firewall** to block known attempts between a vulnerability announcement and your update (our comparison of WordPress firewalls). - **Watch the announcements** that concern your plugins, as described in our vulnerability monitoring method. WP Masquerade Pro helps with this last point. Every day, it compares the versions of installed plugins with the public WPVulnerability.net database and sends you a [vulnerability alert](https://www.wp-masquerade.com/features/vulnerable-plugin-alerts/) by [email](https://www.wp-masquerade.com/features/email-alerts/), with the severity and the fixed version. In the member area, [site monitoring](https://www.wp-masquerade.com/features/#surveillance) groups pending updates and vulnerable sites. WP Masquerade alerts, it does not fix the plugin and is not a firewall: updating remains your decisive step. To choose a firewall or a complete suite, see our [comparison of the best WordPress security plugins](https://www.wp-masquerade.com/best-wordpress-security-plugins/). ### Key takeaways - The free plugin (header-footer-elementor) has 13 vulnerabilities published from 2021 to July 26, 2026, all of medium severity and all requiring an account. - The May 2020 attack targeted the premium version of Ultimate Addons for Elementor, combined with Elementor Pro, not the free plugin. - Ten of the thirteen vulnerabilities are stored XSS in widgets, often the navigation menu. - Recommended minimum version: 2.9.2; limit contributor and author accounts. ## Sources - WordPress.org: Ultimate Addons for Elementor, changelog (1.5.8 to 2.9.2) (https://wordpress.org/plugins/header-footer-elementor/#developers) - Brainstorm Force: Better Together: Ultimate Addons and Header Footer Elementor (https://ultimateelementor.com/better-together-ultimate-addons-and-header-footer-elementor/) - NVD: CVE-2021-24256 (May 5, 2021) (https://nvd.nist.gov/vuln/detail/CVE-2021-24256) - NVD: CVE-2024-10050 (October 24, 2024) (https://nvd.nist.gov/vuln/detail/CVE-2024-10050) Other sources consulted: further CVE records, official vendor pages, trade press articles, Wordfence, WPScan and Patchstack databases. ## WordPress security, without the noise One e-mail when something matters: new attacks seen in the wild, plugin updates and practical guides. No spam, unsubscribe in one click.