CVE-2024-5255

Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_dual_color shortcode in all versions up to, and including, 3.19.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

We have discovered 66,691 live websites that are affected by CVE-2024-5255.

Run a Free Instant Scan



Affected Software

Product  Visual Composer Ultimate Addons
Category Widgets
Vulnerable Domains66,691 live websites (59% of Visual Composer Ultimate Addons install base)
Vulnerable Versions
  • from 0 through 3.19.20
Vulnerable Versions Count73 versions ( 81% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Jul 17, 2024
  • Updated - Apr 8, 2026

Credits

  • haidv35 (finder)

Website Distribution by Country

Number of websites using CVE-2024-5255
United States15,572 websites


Germany6,671 websites
Italy4,279 websites
France3,653 websites
GB3,058 websites
Spain2,803 websites
Russia2,332 websites
Denmark2,023 websites
Netherlands1,818 websites
Poland1,702 websites

Website Distribution by TLD

Number of websites using CVE-2024-5255
.com25,959 websites
.de3,882 websites
.it3,083 websites
.org2,182 websites
.co.uk1,848 websites
.ru1,846 websites
.dk1,762 websites
.nl1,580 websites
.fr1,431 websites
.com.au1,316 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-5255

Top websites that are affected by CVE-2024-5255. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*******.de Germany**,***
**********.com United States**,***
************.com United States**,***
*******.com France**,***
*******.com Sweden**,***
****.********.com Sweden**,***
********.com United States**,***
********.com Canada**,***
******.***.gr Greece**,***
************.ru Russia**,***
See full domain list

FAQ

CVE-2024-5255 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Visual Composer Ultimate Addons
A total of 66,691 websites have been identified as vulnerable to CVE-2024-5255, based on global website indexing conducted by WebTechSurvey.
The Visual Composer Ultimate Addons is affected by the CVE-2024-5255 vulnerability.
Visual Composer Ultimate Addons versions up to and including 3.19.20 are vulnerable to CVE-2024-5255.