EUVD-2026-103425
GHSA-vh8j-6qc6-8fp8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain content-editing access to WordPress
-
DeliveryInject script into PowerPack module field
-
ExploitPayload stored in page/post
-
ExecutionAdmin or visitor loads affected page
-
PersistScript executes in victim browser
-
ImpactSession hijack or privileged action
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to submit content into a PowerPack Lite module field within the Beaver Builder editor, meaning an account with content-creation/editing capability (e.g., contributor or higher) in most configurations - despite the input vector's PR:N. The stored payload only fires when a victim loads the affected page (UI:R), so a second user must view the content for impact to occur; the attacker cannot self-trigger execution in another's session without this. Affects PowerPack Lite for Beaver Builder up to and including version 1.3.1; sites not running this plugin are unaffected. Exact vulnerable field/module is not specified in available data. |
| Impact | This is a Stored Cross-Site Scripting (CWE-79) flaw in the PowerPack Lite for Beaver Builder WordPress plugin (through v1.3.1), rated CVSS 7.1 (High). The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable, low-complexity exploitation with a scope change and limited impact across confidentiality, integrity, and availability, but it requires user interaction (a victim must render the injected content). No EPSS score was supplied, the CVE is NOT present in CISA KEV, and no public proof-of-concept is referenced - so this is a high-CVSS finding without any confirmed real-world exploitation signal. One notable tension: the input vector lists PR:N (unauthenticated), yet stored XSS in a Beaver Builder page-builder addon realistically requires at least contributor/author-level editing capability to persist a payload through the builder - this PR:N value should be verified against the Patchstack advisory, as it materially changes the risk picture. Treat this as a moderate-priority patch item (typical of Patchstack-reported WordPress plugin XSS): worth remediating in normal cycles, but not an emergency absent exploitation evidence. |
| Exploit ScenarioDerived | An attacker with the ability to add or edit content via the Beaver Builder interface injects a malicious script payload into a vulnerable PowerPack module field. The payload is stored and later executes in the browser of any administrator or visitor who views the affected page, enabling session/cookie theft or admin-context actions. No public exploit code is referenced, so exploitation would require an attacker to craft the injection; user interaction (viewing the page) is required per UI:R. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
Stored cross-site scripting in PowerPack Lite for Beaver Builder (WordPress plugin) through version 1.3.1 allows users with content-creation or editing privileges - contributor or higher in most configurations - to inject persistent script into module fields, which executes when another user views the affected page. The flaw is CWE-79 and rated CVSS 7.1 High; scope is changed, with limited confidentiality and integrity impact and no confirmed availability impact. No public exploit code or CISA KEV entry is identified in the available data.
RemediationAI
No vendor-released fixed version is identified in the available data, so treat PowerPack Lite for Beaver Builder 1.3.1 and earlier as vulnerable and monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/powerpack-addon-for-beaver-builder/vulnerability/wordpress-powerpack-lite-for-beaver-builder-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve for a patched release. The most direct mitigation is to disable and remove the plugin until a fix is published; the trade-off is that Beaver Builder layouts depending on PowerPack modules may break, so back up content and stage the change. If removal is not feasible, restrict content-creation and editing privileges to trusted users, remove contributor/author capabilities from untrusted accounts, and strip unfiltered_html; this reduces editorial workflow flexibility. Deploy a WAF or virtual patching rule that blocks script-bearing input to PowerPack module fields, but note that it will not clean payloads already stored in the database. Audit existing Beaver Builder and PowerPack content for injected script and clean affected posts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PowerPack Lite for Beaver Builder is a WordPress plugin that extends the Beaver Builder page builder with additional modules and content fields. The vulnerability is a stored cross-site scripting issue (CWE-79): user-supplied input in a PowerPack Lite module field is not properly neutralized during web page generation, so script content persists in the database and is rendered to other users without adequate output encoding. The independent assessment retains a changed-scope CVSS vector (S:C) and requires an account capable of submitting content into the editor, despite the input vector listing PR:N; the exact vulnerable field or module is not specified in the available data. Successful execution occurs in the context of the affected WordPress site when a victim loads the stored content, allowing actions within that user's browser session subject to the site's cookies and security controls.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Storing the XSS payload requires content-editing capability (PR:L) in a page builder; a victim must view the page (UI:R); payload crosses into the victim's browser (S:C) with no availability impact (A:N).
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1.
Executive ViewAI
PowerPack Lite for Beaver Builder, a WordPress plugin used through version 1.3.1, contains a stored cross-site scripting flaw that lets contributor-level users embed persistent scripts in page modules, which then execute for anyone-including administrators-who views the affected page. No public exploit code has been identified at time of analysis, but the absence of a vendor patch means any site permitting lower-trust users to create or edit content remains exposed to session hijacking and administrative takeover. Leadership should treat this as a governance and access-control issue as much as a plugin defect, because the exposure is concentrated in sites with broad contributor rosters.
No vendor-released patch identified at time of analysis; interim mitigations include deactivating or removing PowerPack Lite for Beaver Builder through 1.3.1 until a fix ships, restricting contributor-and-higher roles to trusted personnel, applying least privilege to administrator accounts, auditing existing module fields for injected scripts, deploying WAF rules or input sanitization targeting stored XSS patterns, and enforcing output encoding on rendered module content.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB