CVE-2026-15382: Unknown Ultimate Addons For Wpbakery Page Builder

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request.

Affected products

• Unknown Ultimate Addons For Wpbakery Page Builder: before 3.21.4 (fixed in 3.21.4)

Published 2026-07-30. Last modified 2026-07-30.