CVE-2026-14921 in Ultimate Addons for WPBakery Page Builder Plugin
Summary
by MITRE • 07/31/2026
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(),
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
The vulnerability exists within the Ultimate Addons for WPBakery Page Builder WordPress plugin version 3.21.5 and earlier, specifically in the shared link-rendering function named Ultimate_VC_Addons::uavc_link_init(). This function serves as a critical component for generating and processing links within the plugin's interface, making it a potential attack surface for malicious actors targeting WordPress installations. The flaw stems from inadequate input validation and sanitization mechanisms within this particular function that handles link generation and rendering operations.
The technical implementation of this vulnerability allows attackers to manipulate the link rendering process through crafted input parameters that bypass normal security checks. When the Ultimate_VC_Addons::uavc_link_init() function processes user-supplied data, it fails to properly sanitize or validate the incoming link information before incorporating it into the page output. This creates opportunities for cross-site scripting attacks where malicious scripts can be injected and executed within the context of a victim's browser session. The vulnerability operates at the application layer and can be exploited through various attack vectors including direct input manipulation, file upload scenarios, or through manipulated shortcode parameters.
The operational impact of this vulnerability extends beyond simple script injection, as it potentially allows for privilege escalation attacks and unauthorized access to sensitive administrative functions within WordPress installations. Attackers can leverage this flaw to execute arbitrary code on vulnerable systems, potentially leading to complete compromise of the affected websites. The vulnerability affects all WordPress installations using the affected plugin version and poses significant risk to users who have administrative access or are running unpatched versions of the software. Security researchers have identified that this issue directly correlates with CWE-79 - Improper Neutralization of Input During Web Page Generation, which addresses the fundamental problem of insufficient input validation in web applications.
Organizations should immediately implement mitigations including patching to version 3.21.5 or later, implementing additional input validation measures, and monitoring for suspicious activity within affected systems. The ATT&CK framework categorizes this vulnerability under T1566 - Phishing with Social Engineering and T1059 - Command and Scripting Interpreter, as attackers can use it to deliver malicious payloads through compromised links. Additional protective measures include implementing web application firewalls, restricting plugin access permissions, and conducting regular security audits of WordPress installations. The vulnerability demonstrates the critical importance of proper input sanitization in content management systems and highlights the need for comprehensive security testing of third-party plugins before deployment in production environments.