Executive brief
Ultimate Addons for WPBakery Page Builder is a popular WordPress plugin used to add advanced design elements to websites. A security flaw allows users with low-level 'Contributor' permissions to embed malicious scripts into buttons or links. If an administrator or site visitor clicks on these links, the script could steal their login session or perform unauthorized actions on the website.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Ultimate Addons for WPBakery Page Builder plugin before version 3.21.5. The shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(), fails to use esc_url() when processing shortcode-supplied URLs, specifically within the [ult_buttons] shortcode. An attacker with Contributor-level privileges can bypass standard WordPress filters (wp_kses_post) by providing a URL-encoded 'javascript:' URI (e.g., 'javascript%3A'). Because the shortcode parser splits on literal colons, the encoded version survives and is rendered directly into the href attribute. When a victim clicks the resulting link, the malicious JavaScript executes in their browser context. This issue was fixed in version 3.21.5.
Affected products
- Brainstorm Force Ultimate Addons for WPBakery Page Builder < 3.21.5
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-31: advisory: NVD published date
- 2026-07-31: patched: Version 3.21.5 released to address the issue