PowerPack Lite for Beaver Builder (<= 1.3.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/powerpack-lite-for-beaver-builder--1.3.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 18 Oct 2026 11:58:05 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored XSS Vulnerability in PowerPack Lite for Beaver Builderhttps://feed.craftedsignal.io/briefs/2026-10-18-cve-2026-110897/Sun, 18 Oct 2026 11:58:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-18-cve-2026-110897/CVE-2026-110897 is a stored Cross-Site Scripting (XSS) vulnerability in the PowerPack Lite for Beaver Builder WordPress plugin that allows unauthenticated or low-privileged attackers to execute arbitrary scripts in a victim's browser session.CVE-2026-110897 describes a stored Cross-Site Scripting (XSS) vulnerability residing in the PowerPack Lite for Beaver Builder plugin (versions 1.3.1 and earlier). The vulnerability is caused by improper neutralization of user-supplied input during web page generation. This flaw permits an attacker to inject malicious JavaScript code into input fields processed by the plugin. When a user with higher privileges - such as an administrator - views the affected page, the stored malicious script executes within their browser session. This can lead to session hijacking, unauthorized actions performed on behalf of the administrator, or the redirection of users to malicious websites. Defenders should prioritize updating the plugin to the latest version, as stored XSS in administrative plugins is a common vector for escalating access within a WordPress environment.

Impact

The vulnerability poses a significant risk to WordPress site integrity. If successfully exploited, an attacker could steal administrator session tokens, create new administrative accounts, or modify site settings. There is no specific victim count available, but the widespread use of Beaver Builder addons makes this a high-value target for attackers looking to compromise WordPress sites.

Recommendation

Prioritize updating the PowerPack Lite for Beaver Builder plugin to the latest available version beyond 1.3.1 to patch the underlying sanitization flaw. Monitor web server logs for suspicious POST requests targeting the plugin's configuration endpoints containing script-like patterns (e.g., <script>, onerror, onload).

]]>highadvisoryxssweb-vulnerabilitywordpress