CVE-2026-14921 Overview
CVE-2026-14921 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Ultimate Addons for WPBakery Page Builder WordPress plugin in versions before 3.21.5. The flaw resides in the shared link-rendering function Ultimate_VC_Addons::uavc_link_init(), which fails to properly sanitize user-controlled input before rendering it in link attributes. An attacker can craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser session within the context of the vulnerable WordPress site.
Critical Impact
Successful exploitation allows attackers to execute arbitrary script in a victim's browser, enabling session theft, credential harvesting, or unauthorized actions performed as the authenticated user.
Affected Products
- Ultimate Addons for WPBakery Page Builder WordPress plugin versions prior to 3.21.5
- WordPress installations using the vulnerable Ultimate_VC_Addons::uavc_link_init() function
- Sites relying on the shared link-rendering component for content output
Discovery Timeline
- 2026-07-31 - CVE-2026-14921 published to NVD
- 2026-07-31 - Last updated in NVD database
Technical Details for CVE-2026-14921
Vulnerability Analysis
The vulnerability is a reflected Cross-Site Scripting (XSS) issue classified under [CWE-79]. It exists in the Ultimate_VC_Addons::uavc_link_init() method, a shared helper used across the plugin to parse and render link attributes for various page-builder components. The function processes attacker-influenced URL parameters and outputs them into HTML link contexts without adequate escaping.
Because the plugin is invoked on public-facing pages, the attack requires no authentication. Exploitation requires user interaction, typically clicking a crafted link. The CVSS scope is marked as changed, reflecting that the injected script executes in the browser origin of the WordPress site, potentially affecting other authenticated sessions and cookies beyond the vulnerable component itself.
Root Cause
The root cause is missing output encoding in uavc_link_init(). Input passed to the link-rendering routine is not sanitized with WordPress escaping functions such as esc_url() or esc_attr() before being emitted into HTML. Attacker-controlled data can therefore break out of the intended attribute context and inject executable script content.
Attack Vector
The attack is delivered over the network by luring a victim into visiting a crafted URL or a page containing a malicious link. When the vulnerable link-rendering routine emits the tainted input, the payload executes in the victim's browser. The vulnerability manifests through unescaped output in HTML anchor attributes. See the WPScan Vulnerability Advisory for the full technical writeup and proof-of-concept details.
Detection Methods for CVE-2026-14921
Indicators of Compromise
- Web server access logs containing suspicious query parameters with <script>, javascript:, onerror=, or onmouseover= payloads targeting pages rendered by the Ultimate Addons plugin
- Outbound requests from client browsers to unfamiliar domains following visits to pages using WPBakery Page Builder content
- Unexpected administrator-level actions or session anomalies correlated with clicks on external referrer URLs
Detection Strategies
- Inventory WordPress deployments and identify sites running Ultimate Addons for WPBakery Page Builder versions below 3.21.5
- Deploy a web application firewall rule to flag requests containing script-injection patterns against URLs invoking plugin shortcodes
- Review browser console telemetry and CSP violation reports for injection attempts on pages using the plugin
Monitoring Recommendations
- Enable and monitor Content Security Policy (CSP) violation reports to identify inline script execution attempts
- Aggregate WordPress and web server logs into a centralized analytics platform to correlate URL patterns with client-side anomalies
- Alert on unusual outbound requests from administrator sessions immediately after link clicks originating from external sources
How to Mitigate CVE-2026-14921
Immediate Actions Required
- Upgrade the Ultimate Addons for WPBakery Page Builder plugin to version 3.21.5 or later on all WordPress installations
- Audit user roles and rotate session cookies for administrator accounts that may have interacted with untrusted links
- Enforce a strict Content Security Policy to block inline script execution on public WordPress pages
Patch Information
The vendor addressed the vulnerability in version 3.21.5 of the Ultimate Addons for WPBakery Page Builder plugin. Site administrators should update through the WordPress plugin manager or by uploading the fixed release. Refer to the WPScan Vulnerability Advisory for advisory details.
Workarounds
- Temporarily deactivate the Ultimate Addons for WPBakery Page Builder plugin until the patch can be applied
- Deploy a WAF rule to filter requests containing script tags, javascript: schemes, or event-handler attributes against plugin endpoints
- Restrict access to WordPress admin interfaces to trusted IP ranges and require multi-factor authentication for privileged accounts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
