CVE-2026-14921

The CVE concerns the WordPress plugin Ultimate Addons for WPBakery Page Builder before 3.21.5. The vulnerability is a Stored XSS in the shared link-rendering function (Ultimate_VC_Addons::uavc_link_init()) triggered via the ult_buttons shortcode. Impact is that attacker-supplied content could be ...