The PowerPack Lite for Beaver Builder plugin contains an improper neutralization of user input during web page generation, enabling stored cross‑site scripting. Attackers can inject malicious scripts that are rendered when any user views the affected page, potentially compromising session data, defacing content, or executing arbitrary code in the context of the site owner’s browser.

Vendors: IdeaBox Creations – PowerPack Lite for Beaver Builder. Versions affected include all releases up to and including 1.3.1.

The CVSS score of 7.1 indicates a high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. The flaw is a stored XSS, which typically requires an attacker to supply input that the plugin stores and subsequently renders. Inferred, the attacker must have access to create or modify content through the plugin’s interface, enabling the injection of malicious scripts.