Ultimate Addons for WPBakery Page Builder vulnerabilities

3 known CVE vulnerabilities in Ultimate Addons for WPBakery Page Builder, translated and rated.

CVE-2026-15382Medium
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 lacks capability and nonce checks when deleting custom icon font packs, allowing unauthenticated attackers to permanently delete all custom icons with a single request.
CVE-2026-34889Medium
Ultimate Addons for WPBakery Page Builder before version 3.21.4 contains a Cross-site Scripting (DOM-Based XSS) vulnerability due to improper neutralization of input during web page generation.
CVE-2025-48088Medium
Stored Cross-site Scripting (XSS) vulnerability in Ultimate Addons for WPBakery Page Builder (ultimate_vc_addons) by Brainstorm_Force. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 3.21.1 (excluding 3.21.1).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS