Cross-Site Scripting in Ultimate Addons for WPBakery Page Builder

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Ultimate Addons for WPBakery Page Builder plugin before version 3.21.5. It allows Contributor-level users to inject malicious JavaScript via the [ult_buttons] shortcode by exploiting improper URL sanitization in the btn_link parameter. The flaw occurs because the plugin outputs user-supplied URLs directly into href attributes without using esc_url().

Useful 0 Not Useful 0

Detection Guidance

Check plugin versions using WordPress admin panel or run: wp plugin list --name='Ultimate Addons for WPBakery Page Builder'. Inspect posts for [ult_buttons] shortcode with malicious btn_link parameters containing javascript: or URL-encoded variants.

Useful 0 Not Useful 0

Impact Analysis

An attacker with Contributor access can craft a malicious link that executes JavaScript when clicked by visitors. This could lead to session hijacking, defacement of the website, or theft of sensitive user data. The impact depends on the privileges of the victim and the nature of the injected script.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Organizations may face compliance penalties if user data is compromised through this exploit.

Useful 0 Not Useful 0

Mitigation Strategies

Update the plugin to version 3.21.5 or later immediately. If updating is not possible, disable the plugin until patched. Review all posts for suspicious [ult_buttons] shortcodes and remove any malicious links.

Useful 0 Not Useful 0