WordPress Ultimate Addons for WPBakery < 3.21.5 Pre-Auth Stored XSS

WordPress Plugin Vulnerabilities Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode Description The plugin's shared link-rendering function, , outputs a shortcode-supplied URL directly into an attribute without calling . This report confirms exploitation through the shortcode. WordPress's filter does not inspect or block the string inside a shortcode attribute value, since it contains no raw HTML tags. This allows a Contributor-level user — who cannot use raw or tags — to instead supply a URI as the link target. The WPBakery shortcode-attribute parser splits on a literal character, so URL-encoding the colon ( ) survives parsing intact and is later decoded and passed straight into with no sanitization. When a victim clicks the resulting link, the JavaScript executes in their browser session. Note: Editor/Administrator roles have by default and are expected to be able to inject scripts via other means — this finding is significant specifically because it requires only Contributor access and bypasses entirely, with no HTML injection needed. CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L (7.5 High) Affected: 3.21.4 (latest at time of testing). No patch available yet. Proof of Concept Affects Plugins ultimate_vc_addons (Fixed in 3.21.5) References CVE: CVE-2026-14921 Classification Type: XSS OWASP top 10: A7: Cross-Site Scripting (XSS) CWE: CWE-79 CVSS: 6.8 (medium) Miscellaneous Original Researcher: Trần Tiến Submitter: Trần Tiến Verified: Yes WPVDB ID: 4bedd9ff-87b6-45ca-9b3e-9e6048693ca6 Timeline Publicly Published: 2026-07-13 (about 18 days ago) Added: 2026-07-13 (about 17 days ago) Last Updated: 2026-07-13 (about 17 days ago) Other Published: 2025-03-19 Title: Frontend Post Submission <= 1.0 - Reflected Cross-Site Scripting Published: 2023-01-27 Title: VikBooking Hotel Booking Engine & PMS < 1.5.12 - Admin+ Stored XSS Published: 2014-08-01 Title: Repagent - dewplayer-vinyl-en.swf xml Parameter XML File H@lling XSS Published: 2024-11-14 Title: WP Activity Log < 5.2.2 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter Published: 2025-02-26 Title: BuddyBoss Platform < 2.8.00 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Ultimate Addons for WPBakery < 3.21.5 Pre-Auth Stored XSS

More from this source