EUVD-2026-51418
GHSA-5rjg-8878-gjp3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS, no auth required, user must click; scope changes to victim browser with low C and I impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(),
AnalysisAI
Reflected cross-site scripting in the Ultimate Addons for WPBakery Page Builder WordPress plugin (all versions before 3.21.5) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL processed by the plugin's shared link-rendering function, uavc_link_init(). A publicly available proof-of-concept exploit was reported by WPScan, though EPSS places exploitation probability at just 0.15% (5th percentile), suggesting opportunistic rather than widespread active exploitation. No CISA KEV listing was identified at the time of analysis.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: the plugin's shared link-rendering helper uavc_link_init() fails to properly sanitize or escape user-supplied link parameters before outputting them into the HTML response. WPBakery Page Builder is a widely used drag-and-drop visual page builder for WordPress, and this plugin extends it with additional content blocks. Reflected XSS occurs when the server echoes attacker-controlled input directly back in the HTTP response without encoding; the injected payload executes in the victim's browser session rather than on the server. The CVSS scope change (S:C) confirms that the impact crosses from the server-side application context into the victim's browser security context. CPE: cpe:2.3:a:unknown:ultimate_addons_for_wpbakery_page_builder:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade Ultimate Addons for WPBakery Page Builder to version 3.21.5 or later, as confirmed by the vendor patch and EUVD-2026-51418. The WPScan advisory at https://wpscan.com/vulnerability/4bebd9ff-87b6-45ca-9b3e-9e6048693ca6/ contains additional context on the fixed release. If immediate upgrade is not possible, consider temporarily disabling any WPBakery blocks or widgets that invoke link-rendering functionality exposed to user-controlled input, though this may break page layout for affected content. As a WordPress-level compensating control, a web application firewall (WAF) rule blocking reflected XSS patterns in query parameters can reduce risk, but WAF rules do not eliminate the underlying flaw and should not substitute for patching. Restricting access to affected pages to authenticated users only would reduce exposure but is rarely feasible on public-facing WordPress sites.
Unauthenticated deletion of all custom icon font packs is possible in Ultimate Addons for WPBakery Page Builder WordPres
The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ulti
The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ulti
The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ult_
The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ulti
The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ulti
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Cross-Site Request Forgery (CSRF) vulnerability in Brain Storm Force Ultimate Addons for WPBakery Page Builder.19.17. Ra
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today