Live › vulnerability › CVE-2026-110897
Go to dashboardPowerPack Lite for Beaver Builder, a WordPress page-builder add-on by IdeaBox Creations, has a stored cross-site scripting flaw. An attacker can plant script in page content that runs in the browser of every visitor, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running PowerPack Lite for Beaver Builder version 1.3.1 or earlier, where the plugin is active alongside Beaver Builder. The sources do not say which configurations or user roles are needed to store the payload, so the exposure of a given site is unknown. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
powerpack-addon-for-beaver-builder plugin header.1.3.1, per the vendor release notes (the exact fixed version is unknown from the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-110897")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.