PLUGIN SECURITY
Is Ultimate Elementor safe?
Membership & community plugin with user profiles, registration & login, member directories, content restriction, user roles and much more.
What this plugin does
- Slug:
ultimate-elementor - Author: Ultimate Member
- 200000+ active installs
- 88/100 rating (1444 reviews on wordpress.org)
- 13454756 all-time downloads
- On WordPress.org since 2015-01-21
communitymembermembershipuser profileUser Registration
Maintenance status
- Latest known version: 2.12.1
- Last updated: 2026-08-24 4:36pm GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.0+
Known vulnerabilities
5 known CVEs on file for Ultimate Elementor. Reported between 2019 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-66688 | Ultimate Addons for Elementor [ultimate-elementor] < 1.45.2.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 1.45.2.1 | 1.45.2.1 | 2026-07-29 | ✓ fixed in latest |
| CVE-2024-37455 | Ultimate Addons for Elementor [ultimate-elementor] < 1.36.32 | Improper Privilege Management | High 8.8 | < 1.36.32 | 1.36.32 | 2024-07-01 | ✓ fixed in latest |
| CVE-2023-50890 | Ultimate Addons for Elementor [ultimate-elementor] < 1.36.21 | Improper Privilege Management | High 8.8 | < 1.36.21 | 1.36.21 | 2023-12-26 | ✓ fixed in latest |
| CVE-2021-24271 | Ultimate Addons for Elementor [ultimate-elementor] < 1.30.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.30.0 | 1.30.0 | 2021-04-13 | ✓ fixed in latest |
| — | Ultimate Addons for Elementor [ultimate-elementor] < 1.30.0 | — | Unknown | < 1.30.0 | 1.30.0 | 2021-04-13 | ✓ fixed in latest |
| CVE-2020-13125 | Ultimate Addons for Elementor [ultimate-elementor] < 1.24.2 | — | Medium 6.5 | < 1.24.2 | 1.24.2 | 2020-05-06 | ✓ fixed in latest |
| — | Ultimate Addons for Elementor [ultimate-elementor] < 1.20.1 | — | Unknown | < 1.20.1 | 1.20.1 | 2019-12-12 | ✓ fixed in latest |
| — | Ultimate Addons for Elementor [ultimate-elementor] < 1.20.1 | — | Unknown | < 1.20.1 | 1.20.1 | 2019-12-12 | ✓ fixed in latest |
+ 2 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| — | Ultimate Addons for Elementor [ultimate-elementor] < 1.20.1 | — | Unknown | < 1.20.1 | 1.20.1 | — | ✓ fixed in latest |
| — | Ultimate Addons for Elementor < 1.20.1 - Authentication Bypass | — | Unknown | < 1.20.1 | 1.20.1 | — | ✓ fixed in latest |
How to fix it
Keep Ultimate Elementor updated — 2.12.1 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- BuddyPress — 90000+ active installs — 82/100 (375) — max PHP <8.0
- Simple Membership — 40000+ active installs — 92/100 (475) — max PHP 8.4
- Ultimate Member – reCAPTCHA — 20000+ active installs — 74/100 (11) — max PHP 8.4
- wpForo Forum — 20000+ active installs — 94/100 (390)
- Asgaros Forum — 10000+ active installs — 96/100 (208)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.