CVE-2026-34889
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Ultimate Addons for WPBakery Page Builder before version 3.21.4 contains a Cross-site Scripting (DOM-Based XSS) vulnerability due to improper neutralization of input during web page generation.
Risk Assessment
An attacker can execute arbitrary script in a user's browser, hijacking the session or performing actions on their behalf.
Recommendation
Upgrade Ultimate Addons for WPBakery Page Builder to version 3.21.4 or later.
Other vulnerabilities in Ultimate Addons for WPBakery Page Builder
See all- CVE-2026-15382Medium
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 lacks capability and nonce checks when deleting custom icon font packs, allowing unauthenticated attackers to permanently delete all custom icons with a single request.
- CVE-2025-48088Medium
Stored Cross-site Scripting (XSS) vulnerability in Ultimate Addons for WPBakery Page Builder (ultimate_vc_addons) by Brainstorm_Force. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 3.21.1 (excluding 3.21.1).
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder allows DOM-Based XSS.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a before 3.21.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS