CVE-2025-62987 describes a stored cross-site scripting vulnerability in the Builderall Builder for WordPress plugin (builderall-cheetah-for-wp) affecting versions up to 3.0.1. The issue stems from improper input neutralization during the generation of web pages, which can allow an attacker with low privileges and requiring user interaction to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information currently available, and no known exploits have been reported.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The attack requires low privileges and user interaction, and the vulnerability affects the Builderall Builder for WordPress plugin up to version 3.0.1. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin and monitoring for suspicious activity related to stored XSS attempts. Avoid enabling untrusted user input in contexts that generate web pages. Follow vendor channels for updates on patches or official mitigations.