CVE-2026-14921

Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(),

We have discovered 108,686 live websites that are affected by CVE-2026-14921.

Run a Free Instant Scan



Affected Software

Product  Visual Composer Ultimate Addons
Category Widgets
Vulnerable Domains108,686 live websites (95% of Visual Composer Ultimate Addons install base)
Vulnerable Versions
  • from 0 through 3.21.5
Vulnerable Versions Count88 versions ( 99% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Jul 31, 2026
  • Updated - Jul 31, 2026

Credits

  • Trần TIến (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-14921
United States27,922 websites


Germany13,253 websites
France6,298 websites
Italy6,160 websites
GB5,107 websites
Spain4,470 websites
Netherlands3,856 websites
Australia2,627 websites
Russia2,621 websites
Denmark2,584 websites

Website Distribution by TLD

Number of websites using CVE-2026-14921
.com42,580 websites
.de8,456 websites
.it4,515 websites
.org3,987 websites
.nl3,461 websites
.co.uk3,249 websites
.fr2,597 websites
.com.au2,506 websites
.dk2,124 websites
.ru2,074 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-14921

Top websites that are affected by CVE-2026-14921. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********.com United States**,***
*******.de Germany**,***
*****.tv Cyprus**,***
**********.com United States**,***
********.com United States**,***
******************.com United States**,***
*****.com United States**,***
****.**.uk United States**,***
*******.com United States**,***
************.com United States**,***
See full domain list

FAQ

CVE-2026-14921 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Visual Composer Ultimate Addons
A total of 108,686 websites have been identified as vulnerable to CVE-2026-14921, based on global website indexing conducted by WebTechSurvey.
The Visual Composer Ultimate Addons is affected by the CVE-2026-14921 vulnerability.
Visual Composer Ultimate Addons versions up to 3.21.5 are vulnerable to CVE-2026-14921.
CVE-2026-14921 is resolved in version 3.21.5 of Visual Composer Ultimate Addons.