Stored XSS in PowerPack Lite Beaver Builder Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

PowerPack Lite for Beaver Builder versions through 1.3.1 contain a Stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. This vulnerability is particularly dangerous because the injected code persists in the application's database, executing every time affected pages are viewed by any user—including administrators. Organizations using this popular WordPress plugin for page building are at risk, as attackers can compromise user sessions, steal credentials, deface content, or redirect visitors to malicious sites. The vulnerability affects anyone relying on PowerPack Lite without applying security patches.

Casky's 323 mapped skills leverage Claude's extended reasoning to identify the attack patterns underlying this vulnerability across MITRE ATT&CK's Initial Access (TA0001) and Persistence (TA0043) tactics. Practitioners using Casky would observe detection findings focused on improper input validation in form submissions and widget configuration fields—the injection points where attackers embed malicious payloads. The platform's skills analyze how unsanitized user input flows into page generation without proper output encoding, flagging suspicious script tags, event handlers, and encoded payloads typical of XSS attacks. Security teams would see recommendations for implementing Content Security Policy headers, input sanitization routines, and output encoding functions—enabling them to both remediate existing instances and prevent similar vulnerabilities in custom plugin development.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-110897.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-110897

Casky has 323 skills that investigate the attack patterns behind CVE-2026-110897. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn