Ultimate Post Kit

Ultimate Post Kit has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 6 are fixed as of September 2026. Their average CVSS score is 5.6, and the most serious one scores 6.4 out of 10. 2026 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (50%). Other recurring categories include Missing Authorization, Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 6 issues recorded for Ultimate Post Kit has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each. Ultimate Post Kit is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

5.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Ultimate Post Kit vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2024-5662

Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) <= 3.11.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Count (Static) Widget

Read the full analysis

Vulnerability Records

6 records


2026-08-08 00:00	Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API Ultimate Post Kit <= 4.2.0	`N/A`	5.4 Medium	Anonymous	Yes
2026-03-18 00:00	Ultimate Post Kit Addons for Elementor <= 4.0.21 - Missing Authorization Ultimate Post Kit <= 4.0.21	`CVE-2026-24362`	4.3 Medium	0xd4rk5id3	Yes
2025-12-10 00:00	Ultimate Post Kit <= 4.0.15 - Unauthenticated Information Disclosure Ultimate Post Kit <= 4.0.15	`CVE-2025-14434`	5.3 Medium	Drtime	Yes
2024-06-27 19:59	Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) <= 3.11.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Count (Static) Widget Ultimate Post Kit <= 3.11.7	`CVE-2024-5662`	6.4 Medium	wesley (wcraft)	Yes
2023-07-18 00:00	Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get Ultimate Post Kit <= 3.6.3	`CVE-2023-33999`	6.1 Medium	Rafie Muhammad	Yes
2022-03-04 00:00	Freemius SDK <= 2.4.2 - Missing Authorization Checks Ultimate Post Kit < 2.9.1	`CVE-2022-4974`	6.3 Medium	Anonymous	Yes

Showing 1–6 of 6 reports

Latestv4.5.3

Ultimate Post Kit

Author

bdthemes

4.8(58)

96/100

Last Updated

2026-09-07 (6d ago)

Active Installs

30,000+

Downloads

1,289,169

Requires WP

6.8+

Requires PHP

7.0+

Tested up to

WP 7.1

Created

2021-04-10 (6y ago)

Ultimate Post Kit for Elementor is an usefull addon for bloggers, marketers, and content creators who want stunning blog layouts without coding. Packed with unique widgets, sliders, and SEO-friendly designs, it helps you showcase posts in a fresh and modern way. Built with clean, optimized code, it’s fully compatible with the latest WordPress standards and won’t slow down your site. Whether you’re a beginner or pro, you can design beautiful, traffic-ready blogs in minutes using Elementor’s drag-and-drop editor. Ultimate Post Kit also supports RTL and multiple languages, making it ready for a global audience. USEFUL LINKS 👇 Live Demo | Documentation | Video Tutorial | Upgrade Pro | Need Support? Introducing Ultimate Post Kit Elementor Addon

View on WordPress.org