The PowerPack Lite for Beaver Builder plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to insufficient input sanitization and output escaping on user-supplied link attributes. Authenticated users with contributor-level or higher privileges can inject arbitrary web scripts into pages, which execute upon page access by any user. This vulnerability affects all versions up to and including 1.3.0. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. No known exploits are reported in the wild, and no patch or official fix has been documented.

An attacker with contributor-level or higher permissions can inject persistent malicious scripts into pages via vulnerable link attributes. These scripts execute in the context of users visiting the affected pages, potentially leading to information disclosure or session hijacking. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires authenticated access, reducing the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or limiting the use of the affected plugin. Monitor vendor channels for updates regarding patches or official mitigations.