The vulnerability allows attackers to inject arbitrary scripts into pages that are rendered by the WordPress Assistant plugin, enabling malicious code to run in the browsers of users who view the affected pages. This can lead to session hijacking, cookie theft, defacement, or delivery of phishing content, thereby compromising the confidentiality and integrity of the affected WordPress site. The weakness is a classic reflected XSS flaw rooted in the programmer’s failure to properly neutralize user input before it reached the browser.

All installations of Beaver Builder’s WordPress Assistant plugin up to and including version 1.5.2 are vulnerable. The plugin is commonly deployed on WordPress sites, so any website that relies on this plugin and has not applied a newer release is at risk.

The CVSS v3.1 score of 7.1 indicates moderate to high severity. An EPSS score of less than 1% suggests that exploitation scripts are not widely distributed, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack path is a crafted URL or form submission that causes the plugin to echo unsanitized data back to the client’s browser; an attacker requires a user with browser access to the site to trigger the payload. No privilege escalation is described, so the vulnerability is primarily a user‑targeted threat.