Stored XSS Vulnerability in PowerPack Lite for Beaver Builder

CVE-2026-110897 describes a stored Cross-Site Scripting (XSS) vulnerability residing in the PowerPack Lite for Beaver Builder plugin (versions 1.3.1 and earlier). The vulnerability is caused by improper neutralization of user-supplied input during web page generation. This flaw permits an attacker to inject malicious JavaScript code into input fields processed by the plugin. When a user with higher privileges - such as an administrator - views the affected page, the stored malicious script executes within their browser session. This can lead to session hijacking, unauthorized actions performed on behalf of the administrator, or the redirection of users to malicious websites. Defenders should prioritize updating the plugin to the latest version, as stored XSS in administrative plugins is a common vector for escalating access within a WordPress environment.

Impact

The vulnerability poses a significant risk to WordPress site integrity. If successfully exploited, an attacker could steal administrator session tokens, create new administrative accounts, or modify site settings. There is no specific victim count available, but the widespread use of Beaver Builder addons makes this a high-value target for attackers looking to compromise WordPress sites.

Recommendation

Prioritize updating the PowerPack Lite for Beaver Builder plugin to the latest available version beyond 1.3.1 to patch the underlying sanitization flaw. Monitor web server logs for suspicious POST requests targeting the plugin's configuration endpoints containing script-like patterns (e.g., <script>, onerror, onload).