The Cloudflare universal certificates cover example.com and *.example.com. This means that it covers any hostname one level below the domain you signed up with. It will cover www.example.com and hostname.example.com, as these are one level below the domain, example.com.
The certificate will not cover www.subdomain.example.com or a.b.example.com, however, as these hostnames are too deep.
You can read more about this and the solutions in this community tutorial.