# Ultimate Addons for WPBakery Page Builder.

Every CVE that names Ultimate Addons for WPBakery Page Builder among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode](https://agentprime.io/advisories/CVE-2026-14921.md)
  `CVE-2026-14921` · CVE record: Unknown Ultimate Addons for WPBakery Page Builder · CVSS 6.1 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Cross-site scripting (XSS)
- [Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Deletion via delete-bsf-fonts](https://agentprime.io/advisories/CVE-2026-15382.md)
  `CVE-2026-15382` · CVE record: Unknown Ultimate Addons for WPBakery Page Builder · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Path traversal

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=ultimate-addons-for-wpbakery-page-builder>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/ultimate-addons-for-wpbakery-page-builder/>. Everything for agents: <https://agentprime.io/llms.txt>.