CVE-2026-110897: WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IdeaBox Creations PowerPack Lite for Beaver Builder (powerpack-addon-for-beaver-builder)to a version that resolves this vulnerability.Fixed in 1.3.2
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must be able to cause malicious input to be stored and then viewed in a web page. The CVSS vector indicates no privileges are required, but user interaction is required for the payload to take effect.
Who is exposed to the impact of a successful exploit?
Users who view a page containing the stored malicious payload may be affected. The reported impact includes low confidentiality, integrity, and availability effects, and the scope may extend beyond the vulnerable plugin's security authority.
Which versions are affected?
PowerPack Lite for Beaver Builder versions through 1.3.1 are affected. The available information does not identify a fixed version.