The Builderall for WordPress plugin accepts a background video service URL value that is stored without proper sanitization or escaping. An attacker with contributor or higher access can insert arbitrary script into this setting, which is later rendered in page output. When a user loads a page containing the injected value, the script runs in the visitor's browser, enabling attackers to steal session cookies, impersonate users, or perform other client‑side attacks. The flaw is a classic stored XSS weakness categorized as CWE‑79.

Any WordPress site that has installed Builderall for WordPress version 3.0.2 or earlier, regardless of other configuration. The vulnerability affects the plugin as a whole and does not depend on site theme or other plugins, but only attackers who have logged‑on with contributor or higher privileges can insert the malicious payload.

The CVSS score of 6.4 indicates a moderate severity, largely due to the requirement for authenticated access to inject the payload. Because the script executes for all visitors of the affected pages, the impact on confidentiality, integrity, and availability can be high if an attacker succeeds. The EPSS score is not available, but the absence of a listing in CISA’s KEV catalog does not diminish the risk; an authenticated attacker could abuse the flaw at any time. The attack vector is internal, requiring contributor‑level or higher roles, but the resultant effect is external, affecting every site visitor who loads a page with the injected value.