The Ultimate Addons for WPBakery plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in versions prior to 3.21.1. This vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied data. An unauthenticated attacker can exploit this flaw to inject arbitrary scripts that execute in the context of users visiting the affected pages. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity with no impact on availability. There is no vendor advisory or patch link provided, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation allows an unauthenticated attacker to inject and execute arbitrary JavaScript in the browsers of users visiting the affected pages, potentially leading to partial confidentiality and integrity compromise. There is no reported impact on availability. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting use of the Ultimate Addons for WPBakery plugin to trusted users only and monitor for suspicious activity. Avoid exposing vulnerable pages to untrusted users. Follow vendor communications for updates and apply patches promptly once available.