As much as I dislike the way XUL has been phased out, it's unlikely I will maintain a separate legacy version.

No changes recently. But many things can go wrong so best to open an issue so the source of the problem can be found:
https://github.com/spenibus/cors-everywhere-firefox-addon/issues

The first option forces the value of the "origin" request header which will also become the value of the "access-control-allow-origin" response header. It's useless for most people and only there for testing purposes.

The whitelist defines which values of "origin" are allowed to bypass CORS when the addon is active. It's a list of fully qualified regular expressions, with delimiters and flags, separated by newlines.
See also this: https://github.com/spenibus/cors-everywhere-firefox-addon/issues/23#issuecomment-447669576

I think the Android tag got added when I switched to WebExtensions, the truth being that this is completely untested. So until I decide to take a good look at it, there is presumably nothing you can do on your end.
You can keep track of the issue here: https://github.com/spenibus/cors-everywhere-firefox-addon/issues/15
This is obviously not getting resolved very fast, although there is no need to remind me every six months.