Description

The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bg_video_service_url' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-10T04:17:46.210Z",
  "pubdate": "2026-09-10T04:17:46.210Z",
  "executiveSummary": "The Builderall for WordPress plugin, in versions up to and including 3.0.2, contains a Stored Cross-Site Scripting (XSS) vulnerability.\nThis flaw arises from inadequate input sanitization and output escaping mechanisms within the 'bg_video_service_url' setting parameter.\nThe vulnerability permits authenticated users, specifically those holding contributor-level access or higher, to inject arbitrary JavaScript payloads into the WordPress environment.\nOnce injected, these malicious scripts execute within the context of other users' sessions whenever they view the affected page.\nThe impact includes the potential for session hijacking, unauthorized actions performed on behalf of legitimate users, and the redirection or modification of content displayed to administrators or site visitors.\nGiven the privilege requirements, an attacker must first obtain legitimate access to the site at a contributor level or higher, limiting the scope of exploitation to authenticated threat actors.\nThis represents a significant security risk to the integrity of the WordPress application and the confidentiality of session data.\nThe primary risk implication is the compromise of administrative or user trust, as malicious scripts are served directly from the trusted domain.",
  "technicalDetails": "The vulnerability resides in the Builderall for WordPress plugin's handling of the 'bg_video_service_url' setting. The plugin fails to perform rigorous server-side validation or input sanitization on this field, allowing unsanitized user-supplied data to be persisted directly into the WordPress database.\nSubsequent output rendering of this stored data lacks appropriate escaping, enabling the execution of malicious scripts when the application displays the value to end-users.\nExploitation follows a predictable sequence: First, an authenticated attacker with contributor-level privileges or higher navigates to the plugin settings interface where the 'bg_video_service_url' parameter is processed. Second, the attacker submits a malicious payload (e.g., <script>alert(document.cookie)</script>) into the field. Third, because the plugin lacks input sanitization, the application commits this script literal to the database as part of the plugin's configuration.\nWhen a legitimate user—such as an administrator or another contributor—visits a page on the site that triggers the rendering of the 'bg_video_service_url' parameter, the browser parses the payload as executable code rather than plain text. This occurs because the plugin does not employ context-aware encoding or output escaping, such as esc_url() or esc_js(), before injecting the stored data into the HTML response.\nThe scope of this vulnerability is limited to the WordPress installation where the plugin is active and configured. Because the script executes within the victim's browser, the attacker can leverage the victim's session tokens to perform unauthorized administrative actions, exfiltrate sensitive site data, or perform forced redirections. The lack of restriction on the payload allows for the inclusion of complex, obfuscated JavaScript, which could be used to facilitate credential harvesting or the installation of persistent malicious hooks.\nThis vulnerability highlights a failure in the plugin's defensive architecture regarding user-controlled configuration inputs. Since the configuration interface is restricted to authenticated users, the attack vector is effectively constrained to those who have already established a level of trust with the application. However, the potential for privilege escalation via session manipulation makes this a critical concern for multi-user WordPress environments."
}