The vulnerability arises from improper neutralization of input during web page generation, enabling the storage of malicious scripts that are later displayed on the website. As a result, browsers rendering affected pages may execute arbitrary JavaScript, presenting a client‑side attack surface.

The Xpro Addons For Beaver Builder – Lite WordPress plugin, from the earliest release through version 1.5.5, is affected.

With a CVSS score of 6.5, the flaw is rated as moderate. The EPSS score is below 1 %, indicating a low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker submitting crafted input via a web form or admin interface that the plugin stores and later displays, and based on the description it is inferred that the stored data is rendered without proper escaping. Remote users who view the affected pages would be susceptible to the injected scripts.