The BM Content Builder plugin for WordPress contains a missing capability check in the function that saves page options. Because of this, an authenticated user with subscriber-level or higher access can inject arbitrary JavaScript into any page. When that page is viewed by other users, the injected scripts run in their browsers, enabling the attacker to steal credentials, forge requests, or perform other client‑side malicious actions. The weakness is classified as CWE‑862, representing a missing authorization test.

SeaTheme’s BM Content Builder plugin, versions up to and including 3.16.2.1, is affected. Systems running any WordPress site that has this plugin installed and has configured subscriber or higher roles are vulnerable.

The CVSS score of 6.4 indicates a medium severity risk. The EPSS score of less than 1% suggests a very low probability that an exploit is currently being attempted, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated subscriber or higher; therefore, it is limited to users who already have legitimate access to the site. Nonetheless, because the injected scripts execute on every visitor to the affected page, the impact can reach a large audience once the attack is performed.