CVE-2026-14921: Improper Neutralization of Input During Web Page Generation

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, UltimateVCAddons::uavclinkinit,...

CVE-2026-15382: External Control of File Name or Path

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request...

CVE-2026-34889: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder allows DOM-Based XSS.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a before 3.21.4...

CVE-2026-28038: Missing Authorization

Missing Authorization vulnerability in BrainstormForce Ultimate Addons for WPBakery Page Builder ultimatevcaddons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through = 3.21.1...

CVE-2025-48088: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BrainstormForce Ultimate Addons for WPBakery Page Builder ultimatevcaddons allows Stored XSS.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through 3.21.1...

PT-2025-42405

Name of the Vulnerable Software and Affected Versions Ultimate Addons for WPBakery plugin for WordPress versions prior to 3.21.1 Description The Ultimate Addons for WPBakery plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping...

CVE-2025-11814: Improper Neutralization of Input During Web Page Generation

The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 3.21.1 exclusive due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2024-5252

The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimateinfotable shortcode in all versions up to, and including, 3.19.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-5254

CVE-2024-5254 concerns the Ultimate Addons for WPBakery Page Builder plugin for WordPress. The vulnerability is Stored Cross-Site Scripting via the ultimate_info_banner shortcode in all versions up to and including 3.19.20, caused by insufficient input sanitization and output escaping on user-sup...

CVE-2024-5255: Improper Neutralization of Input During Web Page Generation

The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimatedualcolor shortcode in all versions up to, and including, 3.19.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-5254: Improper Neutralization of Input During Web Page Generation

The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimateinfobanner shortcode in all versions up to, and including, 3.19.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-5253: Improper Neutralization of Input During Web Page Generation

The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultteam shortcode in all versions up to, and including, 3.19.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-5252: Improper Neutralization of Input During Web Page Generation

The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimateinfotable shortcode in all versions up to, and including, 3.19.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-5251: Improper Neutralization of Input During Web Page Generation

The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimatepricing shortcode in all versions up to, and including, 3.19.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

PT-2024-13341

Name of the Vulnerable Software and Affected Versions Ultimate Addons for WPBakery Page Builder versions 3.19.14 and earlier Description The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability, which allows PHP Local...

CVE-2023-46205: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder allows PHP Local File Inclusion.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through 3.19.14...

PT-2023-31809

Name of the Vulnerable Software and Affected Versions Ultimate Addons for WPBakery Page Builder versions 3.19.17 and earlier Description A Cross-Site Request Forgery CSRF issue affects the Ultimate Addons for WPBakery Page Builder. This issue allows an attacker to perform unintended actions on a...

CVE-2023-51402: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Brain Storm Force Ultimate Addons for WPBakery Page Builder.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through 3.19.17...

CVE-2023-46211: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder plugin = 3.19.14 versions...