Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor

Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor has 16 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 16 are fixed as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 4 critical and 0 high. 2024 was the busiest year with 7 disclosures.

The most common weakness is Cross-Site Scripting, behind 7 of the records (44%). Other recurring categories include Deserialization Of Untrusted Data, Missing Authorization.

Every one of the 16 issues recorded for Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor has a vendor fix available, so running the current release closes all known holes.

10 independent researchers contributed these findings, most of them (3) reported by João Pedro Soares de Alcântara.

Strategic Overview

Avg CVSSMedium

6.7/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2025-39588

Ultimate Store Kit Elementor Addons <= 2.4.0 - Unauthenticated PHP Object Injection

Read the full analysis

Vulnerability Records

16 records


2026-08-08 00:00	Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API Ultimate Store Kit <= 3.0.7	`N/A`	5.4 Medium	Anonymous	Yes
2026-07-28 00:00	Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor <= 3.0.5 - Missing Authorization Ultimate Store Kit <= 3.0.5	`CVE-2026-25403`	5.3 Medium	Bao - BlueRock	Yes
2026-07-22 00:00	Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting Ultimate Store Kit <= 3.0.5	`CVE-2026-65503`	6.4 Medium	Nguyen Ba Khanh	Yes
2026-07-22 00:00	Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor <= 3.0.5 - Unauthenticated Information Exposure Ultimate Store Kit <= 3.0.5	`CVE-2026-65505`	5.3 Medium	Bao - BlueRock	Yes
2025-12-30 00:00	Ultimate Store Kit Elementor Addons <= 2.9.4 - Missing Authorization Ultimate Store Kit <= 2.9.4	`CVE-2025-69336`	4.3 Medium	Phat RiO	Yes
2025-09-22 00:00	Ultimate Store Kit Elementor Addons <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting Ultimate Store Kit <= 2.8.6	`CVE-2025-58017`	6.4 Medium	Abu Hurayra (HurayraIIT)	Yes
2025-04-30 14:30	Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.4.1 - Cross-Site Request Forgery to Limited User Meta Update Ultimate Store Kit <= 2.4.1	`CVE-2025-2168`	4.3 Medium	Peter Thaleikis	Yes
2025-04-17 00:00	Ultimate Store Kit Elementor Addons <= 2.4.0 - Unauthenticated PHP Object Injection Ultimate Store Kit <= 2.4.0	`CVE-2025-39588`	9.8 Critical	domiee13	Yes
2025-04-04 00:00	Ultimate Store Kit Elementor Addons <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Ultimate Store Kit <= 2.5.0	`CVE-2025-32184`	6.4 Medium	João Pedro Soares de Alcântara	Yes
2024-12-19 00:00	Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.3.0 - Missing Authorization Ultimate Store Kit <= 2.3.0	`CVE-2025-24584`	4.3 Medium	João Pedro Soares de Alcântara	Yes

Showing 1–10 of 16 reports