Ultimate Addons for WPBakery

Ultimate Addons for WPBakery has 15 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2026; all 15 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2024 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 11 of the records (73%). Other recurring categories include Path Traversal, Cross-Site Request Forgery (CSRF).

Every one of the 15 issues recorded for Ultimate Addons for WPBakery has a vendor fix available, so running the current release closes all known holes.

7 independent researchers contributed these findings, most of them (5) reported by haidv35.

Strategic Overview

Avg CVSSMedium

6.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Ultimate Addons for WPBakery vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8

Ultimate Addons for WPBakery <= 3.16.11 - Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

15 records


2026-07-10 00:00	Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Deletion Ultimate Addons for WPBakery < 3.21.4	`CVE-2026-15382`	5.3 Medium	Trần Tiến	Yes
2026-04-01 00:00	Ultimate Addons for WPBakery Page Builder < 3.21.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Ultimate Addons for WPBakery < 3.21.4	`CVE-2026-34889`	6.4 Medium	Bonds	Yes
2026-03-02 00:00	Ultimate Addons for WPBakery Page Builder <= 3.21.1 - Missing Authorization Ultimate Addons for WPBakery <= 3.21.1	`CVE-2026-28038`	4.3 Medium	João Pedro Soares de Alcântara	Yes
2025-10-10 00:00	Ultimate Addons for WPBakery Page Builder < 3.21.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Ultimate Addons for WPBakery < 3.21.1	`CVE-2025-48088`	6.4 Medium	stealthcopter	Yes
2025-10-10 00:00	Ultimate Addons for WPBakery Page Builder < 3.21.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Ultimate Addons for WPBakery < 3.21.1	`CVE-2025-11814`	6.4 Medium	stealthcopter	Yes
2024-07-16 18:33	Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Ultimate Addons for WPBakery <= 3.19.20	`CVE-2024-5254`	6.4 Medium	haidv35	Yes
2024-07-16 18:30	Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Ultimate Addons for WPBakery <= 3.19.20	`CVE-2024-5255`	6.4 Medium	haidv35	Yes
2024-07-16 18:30	Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Ultimate Addons for WPBakery <= 3.19.20	`CVE-2024-5252`	6.4 Medium	haidv35	Yes
2024-07-16 18:29	Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Ultimate Addons for WPBakery <= 3.19.20	`CVE-2024-5253`	6.4 Medium	haidv35	Yes
2024-07-16 18:29	Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Ultimate Addons for WPBakery <= 3.19.20	`CVE-2024-5251`	6.4 Medium	haidv35	Yes

Showing 1–10 of 15 reports