CVE-2026-15382
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 lacks capability and nonce checks when deleting custom icon font packs, allowing unauthenticated attackers to permanently delete all custom icons with a single request.
Risk Assessment
Risk of losing all custom site icons, potentially affecting site appearance and functionality.
Recommendation
Update the plugin to version 3.21.4 or later immediately.
Other vulnerabilities in Ultimate Addons for WPBakery Page Builder
See all- CVE-2026-34889Medium
Ultimate Addons for WPBakery Page Builder before version 3.21.4 contains a Cross-site Scripting (DOM-Based XSS) vulnerability due to improper neutralization of input during web page generation.
- CVE-2025-48088Medium
Stored Cross-site Scripting (XSS) vulnerability in Ultimate Addons for WPBakery Page Builder (ultimate_vc_addons) by Brainstorm_Force. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 3.21.1 (excluding 3.21.1).
Original NVD description (English source)
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS