{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/powerpack-lite-for-beaver-builder--1.3.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ideaboxcreations:powerpack_lite_for_beaver_builder:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-110897"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PowerPack Lite for Beaver Builder (\u003c= 1.3.1)"],"_cs_severities":["high"],"_cs_tags":["xss","web-vulnerability","wordpress"],"_cs_type":"advisory","_cs_vendors":["IdeaBox Creations"],"content_html":"\u003cp\u003eCVE-2026-110897 describes a stored Cross-Site Scripting (XSS) vulnerability residing in the PowerPack Lite for Beaver Builder plugin (versions 1.3.1 and earlier). The vulnerability is caused by improper neutralization of user-supplied input during web page generation. This flaw permits an attacker to inject malicious JavaScript code into input fields processed by the plugin. When a user with higher privileges - such as an administrator - views the affected page, the stored malicious script executes within their browser session. This can lead to session hijacking, unauthorized actions performed on behalf of the administrator, or the redirection of users to malicious websites. Defenders should prioritize updating the plugin to the latest version, as stored XSS in administrative plugins is a common vector for escalating access within a WordPress environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a significant risk to WordPress site integrity. If successfully exploited, an attacker could steal administrator session tokens, create new administrative accounts, or modify site settings. There is no specific victim count available, but the widespread use of Beaver Builder addons makes this a high-value target for attackers looking to compromise WordPress sites.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize updating the PowerPack Lite for Beaver Builder plugin to the latest available version beyond 1.3.1 to patch the underlying sanitization flaw. Monitor web server logs for suspicious POST requests targeting the plugin's configuration endpoints containing script-like patterns (e.g., \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e, \u003ccode\u003eonerror\u003c/code\u003e, \u003ccode\u003eonload\u003c/code\u003e).\u003c/p\u003e\n","date_modified":"2026-10-18T11:58:05Z","date_published":"2026-10-18T11:58:05Z","id":"https://feed.craftedsignal.io/briefs/2026-10-18-cve-2026-110897/","summary":"CVE-2026-110897 is a stored Cross-Site Scripting (XSS) vulnerability in the PowerPack Lite for Beaver Builder WordPress plugin that allows unauthenticated or low-privileged attackers to execute arbitrary scripts in a victim's browser session.","title":"Stored XSS Vulnerability in PowerPack Lite for Beaver Builder","url":"https://feed.craftedsignal.io/briefs/2026-10-18-cve-2026-110897/"}],"language":"en","title":"CraftedSignal Threat Feed - PowerPack Lite for Beaver Builder (\u003c= 1.3.1)","version":"https://jsonfeed.org/version/1.1"}