The Ultimate Addons for Beaver Builder – Lite WordPress plugin suffers from a stored XSS vulnerability (CWE-79) in its Advanced Icons widget. This vulnerability allows authenticated users with contributor or higher privileges to inject arbitrary web scripts into pages. These scripts execute in the context of users who visit the compromised pages, potentially leading to session hijacking or other script-based attacks. The issue arises from inadequate input sanitization and output escaping in the plugin versions up to and including 1.5.7. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity with no availability impact.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the Advanced Icons widget. These scripts execute in the browsers of users who view the infected pages, potentially compromising user data confidentiality and integrity. There is no direct impact on system availability. The vulnerability could facilitate session hijacking, defacement, or other client-side attacks depending on the injected payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or avoiding use of the Advanced Icons widget. Monitor for plugin updates from Brainstormforce and apply them promptly once available.