CVE-2026-14921 PUBLISHED

Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode

Assigner: WPScan
Reserved: 07.07.2026 Published: 31.07.2026 Updated: 31.07.2026

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(),

Product Status

Vendor Unknown
Product Ultimate Addons for WPBakery Page Builder
Versions Default: unaffected
  • affected from 0 to 3.21.5 (excl.)

Credits

  • Trần TIến finder
  • WPScan coordinator

References

Problem Types

  • CWE-79 Cross-Site Scripting (XSS) CWE