Executive brief
The Builderall for WordPress plugin allows authenticated website contributors and administrators to inject malicious JavaScript code into page settings that executes when other users view the page. An attacker with contributor-level access or higher can inject arbitrary scripts that steal session credentials, redirect users, or perform actions on their behalf, affecting any visitor to the compromised page.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the 'bg_video_service_url' setting caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript through this parameter, which is stored in the database and reflected to all users accessing pages containing the setting. The vulnerability requires authentication and contributor privileges to exploit, but impacts all site visitors once injected. Patches are available in versions after 3.0.2.
Affected products
- Builderall Builderall for WordPress up to and including 3.0.2
Timeline
- 2026-09-10: disclosed