Brainstorm Force Ultimate Addons CVE-2026-34889

The vulnerability is a DOM-based XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in the Ultimate Addons for WPBakery Page Builder WordPress plugin. WPBakery is a visual page builder that allows users to design pages through a drag-and-drop interface. The plugin extends WPBakery with additional UI components and addons. DOM-based XSS occurs when client-side JavaScript code processes user input unsafely, directly writing it to the DOM without proper sanitization or encoding. In this case, the plugin's frontend or editor interface fails to neutralize user-supplied input before rendering it in the page's HTML structure, allowing an attacker with plugin access to craft malicious payloads that execute in the context of other authenticated users' browsers.