CVE-2026-15382mediumobserved exploitationCWE-73

CVE-2026-15382: medium-severity vulnerability in Ultimate Addons for WPBakery Page Builder

Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Deletion via delete-bsf-fonts

Published

Follow this CVE+ Monitor Ultimate Addons for WPBakery Page Builder

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

55Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actcvss 6.5epss 0.4%
from disclosure to weapon
Published on NVDJul 30
VulnCheck+77d
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected products
Unknown · Ultimate Addons for WPBakery Page Builder
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Ultimate Addons for WPBakery Page Builder

In the same product, most dangerous first.

CVE-2026-14921MEDIUMUltimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons ShortcodeEPSS 0.3%