The Ultimate Addons for WPBakery plugin has a stored cross‑site scripting flaw caused by insufficient input sanitization and output escaping. A malicious payload can be stored in a writable field and executed automatically in the browsers of any user who visits the affected page, allowing the attacker to run arbitrary client‑side code. The CVE description does not specify additional consequences such as credential theft or session hijacking.

All versions of the Ultimate Addons for WPBakery plugin for WordPress prior to 3.21.1, maintained by Brainstorm Force, are affected. Sites running WordPress with the WPBakery Page Builder and the plugin installed and active are at risk.

The CVSS score of 6.4 classifies the issue as moderate severity, and the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers can inject a malicious payload via a writable field in the plugin—even without authentication—so no prior credentials are required. Once stored, the script is delivered to every visitor of the page, resulting in arbitrary client‑side code execution.