Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode

Description

The plugin's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(),
outputs a shortcode-supplied URL directly into an href attribute without calling
esc_url(). This report confirms exploitation through the [ult_buttons] shortcode.

WordPress's wp_kses_post filter does not inspect or block the string inside a
shortcode attribute value, since it contains no raw HTML tags. This allows a
Contributor-level user — who cannot use raw <script> or <img onerror> tags — to
instead supply a javascript: URI as the link target.

The WPBakery shortcode-attribute parser splits on a literal ':' character, so
URL-encoding the colon ('javascript%3A') survives parsing intact and is later
decoded and passed straight into href="..." with no esc_url() sanitization.
When a victim clicks the resulting link, the JavaScript executes in their
browser session.

Note: Editor/Administrator roles have unfiltered_html by default and are
expected to be able to inject scripts via other means — this finding is
significant specifically because it requires only Contributor access and
bypasses wp_kses_post entirely, with no HTML injection needed.

CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L (7.5 High)

Affected: 3.21.4 (latest at time of testing). No patch available yet.