CVE-2025-48088

MediumCVSS 6.5

Published: 27/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

5th percentile - higher than 5% of all known CVEs

Summary

Stored Cross-site Scripting (XSS) vulnerability in Ultimate Addons for WPBakery Page Builder (ultimate_vc_addons) by Brainstorm_Force. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 3.21.1 (excluding 3.21.1).

Risk Assessment

An attacker can inject malicious script that will be executed in the browser of an administrator or other users, potentially leading to session theft, account takeover, or other harmful actions.

Recommendation

It is recommended to update the Ultimate Addons for WPBakery Page Builder plugin to version 3.21.1 or later, which includes a fix for this vulnerability.

Other vulnerabilities in Ultimate Addons for WPBakery Page Builder

CVE-2026-15382Medium
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 lacks capability and nonce checks when deleting custom icon font packs, allowing unauthenticated attackers to permanently delete all custom icons with a single request.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm_Force Ultimate Addons for WPBakery Page Builder ultimate_vc_addons allows Stored XSS.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through < 3.21.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS