{"id":"CVE-2026-125831","kind":"vulnerability","aliases":["CVE-2026-125831"],"related":[],"title":"PowerPack Lite for Beaver Builder: stored XSS lets attackers run scripts in pages","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.2.","summary":"PowerPack Lite for Beaver Builder, a WordPress page-builder add-on by IdeaBox Creations, does not neutralize input when it generates web pages. An attacker can store script code that runs in other visitors' browsers, including site administrators.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["beaver-builder","package","powerpack-lite","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed PowerPack Lite for Beaver Builder plugin version in the WordPress admin plugin list","fix":"- PowerPack Lite for Beaver Builder: a version later than `1.3.2`; the exact fixed version is unknown","status":"open","published_at":"2026-11-13T15:17:42+00:00","first_seen_at":"2026-11-13T15:46:18+00:00","triaged_at":"2026-11-13T15:48:45+00:00","updated_at":"2026-11-13T15:48:45+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-13T15:48:45Z","model":"claude-haiku-5-5","output":{"fix":"- PowerPack Lite for Beaver Builder: a version later than `1.3.2`; the exact fixed version is unknown","reach":"internet","title":"PowerPack Lite for Beaver Builder: stored XSS lets attackers run scripts in pages","impact":"medium","summary":"PowerPack Lite for Beaver Builder, a WordPress page-builder add-on by IdeaBox Creations, does not neutralize input when it generates web pages. An attacker can store script code that runs in other visitors' browsers, including site administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","beaver-builder","powerpack-lite"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Stored scripts run in visitors' browsers, including administrators","analyst_note":"Confirm the fixed version and required privilege from the NVD entry or the vendor's plugin changelog, since the sources give only 'through 1.3.2'.","how_to_check":"- Check the installed PowerPack Lite for Beaver Builder plugin version in the WordPress admin plugin list\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running PowerPack Lite for Beaver Builder at version 1.3.2 or earlier, where page content can be edited by users who can store input. Sites without this plugin are not affected. The sources do not say which configurations or roles are required.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000741,"input_tokens":4581,"output_tokens":565,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125831':16A,19A '-2026':15A,18A '1.3.2':108C 'add':39B 'add-on':38B 'addon':91C 'administr':67B 'affect':99C 'allow':95C 'attack':9A,54B 'beaver':4A,21B,31B,87C,93C,103C 'beaver-build':20B 'browser':64B 'builder':5A,22B,32B,37B,88C,94C,104C 'code':58B 'creation':43B,83C 'cross':77C 'cross-sit':76C 'cve':14A,17A 'generat':50B,75C 'ideabox':42B,82C 'improp':68C 'includ':65B 'input':47B,71C 'issu':98C 'let':8A 'lite':2A,26B,29B,85C,101C 'n/a':106C 'neutral':46B,69C 'packag':23B 'page':13A,36B,52B,74C 'page-build':35B 'powerpack':1A,25B,28B,84C,90C,100C 'powerpack-addon-for-beaver-build':89C 'powerpack-lit':24B 'run':10A,60B 'script':11A,57B,79C 'site':66B,78C 'store':6A,56B,96C 'visitor':63B 'vulner':80C 'web':51B,73C 'wordpress':27B,34B 'xss':7A 'xss.this':97C","nicknames":[],"mitigations":[],"who_affected":"Sites running PowerPack Lite for Beaver Builder at version 1.3.2 or earlier, where page content can be edited by users who can store input. Sites without this plugin are not affected. The sources do not say which configurations or roles are required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["beaverbuilder","medium","package","powerpacklite","wordpress"],"campaign_type":null,"search_a":"'-125831':16A,19A '-2026':15A,18A 'attack':9A 'beaver':4A 'builder':5A 'cve':14A,17A 'let':8A 'lite':2A 'page':13A 'powerpack':1A 'run':10A 'script':11A 'store':6A 'xss':7A","search_b":"'add':39B 'add-on':38B 'administr':67B 'attack':54B 'beaver':21B,31B 'beaver-build':20B 'browser':64B 'builder':22B,32B,37B 'code':58B 'creation':43B 'generat':50B 'ideabox':42B 'includ':65B 'input':47B 'lite':26B,29B 'neutral':46B 'packag':23B 'page':36B,52B 'page-build':35B 'powerpack':25B,28B 'powerpack-lit':24B 'run':60B 'script':57B 'site':66B 'store':56B 'visitor':63B 'web':51B 'wordpress':27B,34B","search_c":"'1.3.2':108C 'addon':91C 'affect':99C 'allow':95C 'beaver':87C,93C,103C 'builder':88C,94C,104C 'creation':83C 'cross':77C 'cross-sit':76C 'generat':75C 'ideabox':82C 'improp':68C 'input':71C 'issu':98C 'lite':85C,101C 'n/a':106C 'neutral':69C 'page':74C 'powerpack':84C,90C,100C 'powerpack-addon-for-beaver-build':89C 'script':79C 'site':78C 'store':96C 'vulner':80C 'web':73C 'xss.this':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125831","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125831","severity":null,"published_at":"2026-11-13T15:17:42+00:00","modified_at":"2026-11-13T15:17:42+00:00","first_seen_at":"2026-11-13T15:46:18+00:00","fetched_at":"2026-11-13T15:46:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}