CVE-2026-15796 in Builderall Plugin
Summary
by MITRE • 09/10/2026
The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bg_video_service_url' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified within the Builderall plugin for WordPress represents a significant security risk stemming from inadequate handling of user-supplied input during the configuration process. Specifically, the flaw resides in how the application processes and renders data associated with the bg_video_service_url setting across all versions up to 3.0.2. The core technical deficiency is characterized by insufficient input sanitization combined with a lack of proper output escaping when this specific parameter is rendered on the frontend or administrative interfaces. This architectural oversight allows malicious actors who have achieved authenticated access at the contributor level or higher to inject arbitrary JavaScript code into the application's database, which is subsequently served to other users without validation.
From an operational perspective, this vulnerability facilitates a Stored Cross-Site Scripting attack vector where the injected payload persists on the target server rather than being transient in the URL parameters as seen in reflected XSS attacks. When any user accesses a page containing the compromised setting, their browser executes the malicious scripts within the context of the vulnerable site's domain. This execution environment grants the attacker significant capabilities, including but not limited to session hijacking through cookie theft, credential harvesting via fake login forms injected into legitimate pages, and potentially performing actions on behalf of the victim user if they possess administrative privileges. The persistence of this payload means that every subsequent visitor or administrator interacting with the affected page becomes a potential target for exploitation without needing further interaction from the initial attacker.
This incident aligns closely with Common Weakness Enumeration identifiers such as CWE-79, which classifies Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Furthermore, in terms of tactical mapping within the MITRE ATT&CK framework for enterprise security, this vulnerability supports techniques associated with Collection and Credential Access, specifically leveraging browser-based mechanisms to exfiltrate sensitive data or maintain persistence through injected scripts that monitor user activity. The requirement for contributor-level access indicates that while the attack surface is somewhat restricted by authentication requirements, it remains viable against any internal threat actor who has been granted basic editing privileges within the WordPress ecosystem.
Mitigation strategies must prioritize immediate remediation of the codebase to ensure all dynamic content undergoes rigorous sanitization before storage and strict escaping upon output rendering. Developers should implement context-aware encoding functions provided by the WordPress framework, such as esc_html or wp_kses_post depending on the expected data type for video service URLs, to neutralize any script tags or event handlers embedded within user input. Additionally, organizations relying on this plugin version are advised to upgrade to a patched release that addresses these sanitization gaps immediately. In environments where upgrading is not instantly feasible, implementing Web Application Firewall rules can provide temporary protection by detecting and blocking requests containing common XSS payloads targeting the specific parameter involved in this vulnerability.