What’s Vulnerable › Products

brainstormforce Ultimate Addons for Elementor vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your brainstormforce Ultimate Addons for Elementor version is affected

Latest brainstormforce Ultimate Addons for Elementor vulnerabilities

• CVE-2026-15787 — Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes (CVSS 6.4)
• CVE-2025-8488 — Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) <= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update (CVSS 4.3)
• CVE-2024-11230 — Elementor Header & Footer Builder <= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget (CVSS 5.4)
• CVE-2024-10325 — Elementor Header & Footer Builder <= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 5.4)
• CVE-2024-10050 — Elementor Header & Footer Builder <= 1.6.43 - Authenticated (Contributor+) Information Disclosure via Shortcode (CVSS 4.3)
• CVE-2024-2618 — Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2024-2619 — Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Author+) HTML Injection (CVSS 5.4)
• CVE-2024-4634 — Elementor Header & Footer Builder <= 1.6.28 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2024-1237 — Elementor Header & Footer Builder <= 1.6.24 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)