The Builderall Builder for WordPress plugin contains an improper neutralization of input during web page generation that allows stored XSS. Injected malicious scripts are persisted in the site’s content and executed in the browsers of all users who view the affected pages. This can lead to session hijacking, data theft, defacement, or installation of additional malware while compromising confidentiality and integrity of user data.

The vulnerability exists in the Builderall Builder for WordPress product from Builderall, affecting all releases up to and including version 3.0.1. No later releases are indicated as affected.

With a CVSS score of 6.5, the vulnerability carries moderate severity. The EPSS score below 1% suggests a low probability of exploitation at this time, and it is not listed in the CISA KEV catalog. Attackers would need to inject content through the plugin’s administrative interface or other content‑creation channels, after which any user who views the stored payload can be impacted. The attack vector is likely remote, web‑based, and requires some level of user access to the site’s backend or ability to add content.