The Visual Builder plugin from dastan800 contains a missing authorization flaw that allows an attacker to inject and execute reflected XSS payloads. Because the flaw is rooted in improper authorization (CWE‑862), an attacker can target authenticated users or the site’s administrators, potentially hijacking sessions, defacing content, or stealing credentials.

The vulnerability affects all releases of the Visual Builder WordPress plugin up through version 1.2.2. Any site using this plugin—regardless of WordPress version—is at risk unless the plugin is upgraded or disabled.

With a CVSS base score of 7.1 and an EPSS of less than 1 %, the overall risk is moderate. The flaw is not listed in the CISA KEV catalog, and while the exploitation requires a crafted request to the plugin’s endpoints, it can be delivered via a simple link or form submission. An attacker who successfully delivers the payload could execute client‑side code with the privileges of the victim user, leading to XSS and potential privilege escalation.