The vulnerability is a stored cross‑site scripting flaw that allows an authenticated user with post.create or post.edit permissions to inject script or event‑handler markup into unsanitized design_json block content. When the block is rendered by the text‑editor, HTML, text or heading widgets, the injected code executes in the browser of any administrator or Superadmin who views the builder, preview or page.

All installations of LaraDashboard earlier than version 1.4.9 are affected. The flaw resides in the LaraBuilder design_json block processing code. Any instance that permits content managers with write privileges to create or edit posts can be exploited.

The CVSS score of 5.1 indicates a moderate impact. The EPSS value is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and hold both post.create or post.edit permissions, which are typically granted to content managers. Once injected, the script runs in the context of the administrator who views the content, allowing the attacker to execute arbitrary code in privileged sessions. If such permissions are unavailable, the exposure is limited to users with those roles.