Medium · 6.1 CVE-2026-14921 EUVD-2026-51418GHSA-5rjg-8878-gjp3

Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode

Published Jul 31, 2026 · Updated Jul 31, 2026 · Assigned by WPScan

Description

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(),

Vendor	Product	Affected	Fixed
—	Ultimate Addons for WPBakery Page Builder	< 3.21.5	3.21.5