The Supreme Addons for Beaver Builder plugin for WordPress contains an input validation weakness in its auto_qrcodesabb shortcode. Unsanitized, user‑supplied attributes are stored and later rendered without proper escaping, enabling the injection of arbitrary JavaScript. When an authenticated contributor or higher user deploys the shortcode with crafted attributes, the malicious script becomes part of the page content and will execute in the browsers of any visitor who loads the affected page, potentially giving an attacker access to session cookies, defacing content, or executing further actions on behalf of the victim.

Version 1.0.9 and all earlier releases of the Supreme Addons for Beaver Builder plugin for WordPress, developed by ullakalim8, are affected. The flaw is present in the auto_qrcodesabb shortcode shipped with these releases.

The CVSS base score of 6.4 places this vulnerability in the medium severity range. The EPSS score of less than 1% indicates that the likelihood of exploitation is currently very low, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known weaponized exploit. An attacker must first authenticate to the WordPress site with a role of Contributor or greater to inject the payload, implying that internal credentials or compromised accounts are required. Once injected, the cross‑site scripting can affect any user who views the compromised page, posing a threat to confidentiality, integrity, and availability of the affected WordPress site.