WordPress header-footer-elementor has 8 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2024-1237 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the flyout_layout attribute in a | medium | 6.4 | <1.6.25 | 1.6.25 |
| CVE-2024-10050 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 1.6 | medium | 4.3 | <1.6.44 | 1.6.44 |
| CVE-2024-5757 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url attribute within the pl | medium | 6.4 | <1.6.36 | 1.6.36 |
| CVE-2024-2619 | The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insu | medium | 5.0 | <1.6.27 | 1.6.27 |
| CVE-2024-4634 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hfe_svg_mime_types’ functio | medium | 6.4 | <1.6.29 | 1.6.29 |
| CVE-2024-2618 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the size attribute in all versio | medium | 6.4 | <1.6.27 | 1.6.27 |
| CVE-2024-10325 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all | medium | 6.4 | <1.6.46 | 1.6.46 |
| CVE-2024-11230 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all vers | medium | 6.4 | <=1.6.46 | – |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked