{"id":"CVE-2026-110897","kind":"vulnerability","aliases":["CVE-2026-110897"],"related":[],"title":"PowerPack Lite for Beaver Builder: stored XSS lets attackers run scripts","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1.","summary":"PowerPack Lite for Beaver Builder, a WordPress page-builder add-on by IdeaBox Creations, has a stored cross-site scripting flaw. An attacker can plant script in page content that runs in the browser of every visitor, including administrators.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["beaver-builder","package","powerpack","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in the `powerpack-addon-for-beaver-builder` plugin header.\n- Confirm whether the Beaver Builder page builder and PowerPack Lite are active on the site.","fix":"- Update PowerPack Lite for Beaver Builder to a version later than `1.3.1`, per the vendor release notes (the exact fixed version is unknown from the sources).","status":"open","published_at":"2026-10-18T11:16:37+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:36:09+00:00","updated_at":"2026-10-25T03:36:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:36:09Z","model":"claude-haiku-5-5","output":{"fix":"- Update PowerPack Lite for Beaver Builder to a version later than `1.3.1`, per the vendor release notes (the exact fixed version is unknown from the sources).","reach":"internet","title":"PowerPack Lite for Beaver Builder: stored XSS lets attackers run scripts","impact":"medium","summary":"PowerPack Lite for Beaver Builder, a WordPress page-builder add-on by IdeaBox Creations, has a stored cross-site scripting flaw. An attacker can plant script in page content that runs in the browser of every visitor, including administrators.","category":"package","nicknames":[],"who_cares":["wordpress","beaver-builder","powerpack","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in visitors' and admins' browsers","analyst_note":"Confirm the fixed version and whether storing the payload requires a contributor or other logged-in role, from the NVD entry and the plugin's changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in the `powerpack-addon-for-beaver-builder` plugin header.\n- Confirm whether the Beaver Builder page builder and PowerPack Lite are active on the site.","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running PowerPack Lite for Beaver Builder version 1.3.1 or earlier, where the plugin is active alongside Beaver Builder. The sources do not say which configurations or user roles are needed to store the payload, so the exposure of a given site is unknown. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000645,"input_tokens":3344,"output_tokens":621,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110897':14A,17A '-2026':13A,16A '1.3.1':109C 'add':38B 'add-on':37B 'addon':92C 'administr':68B 'affect':100C 'allow':96C 'attack':9A,52B 'beaver':4A,19B,30B,88C,94C,104C 'beaver-build':18B 'browser':63B 'builder':5A,20B,31B,36B,89C,95C,105C 'content':58B 'creation':42B,84C 'cross':47B,78C 'cross-sit':46B,77C 'cve':12A,15A 'everi':65B 'flaw':50B 'generat':76C 'host':25B 'ideabox':41B,83C 'improp':69C 'includ':67B 'input':72C 'issu':99C 'let':8A 'lite':2A,28B,86C,102C 'n/a':107C 'neutral':70C 'packag':21B 'page':35B,57B,75C 'page-build':34B 'plant':54B 'powerpack':1A,22B,27B,85C,91C,101C 'powerpack-addon-for-beaver-build':90C 'run':10A,60B 'script':11A,49B,55B,80C 'self':24B 'self-host':23B 'site':48B,79C 'store':6A,45B,97C 'visitor':66B 'vulner':81C 'web':74C 'wordpress':26B,33B 'xss':7A 'xss.this':98C","nicknames":[],"mitigations":[],"who_affected":"Sites running PowerPack Lite for Beaver Builder version 1.3.1 or earlier, where the plugin is active alongside Beaver Builder. The sources do not say which configurations or user roles are needed to store the payload, so the exposure of a given site is unknown. Sites that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T11:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110897","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110897","severity":null,"published_at":"2026-10-18T11:16:37+00:00","modified_at":"2026-10-19T16:17:03+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}