Murad Mirzayev

**Name of the Vulnerable Software and Affected Versions** SP Page Builder versions prior to 6.7.0 **Description** An unauthenticated attacker can perform a stored Cross-Site Scripting (XSS) attack—where malicious scripts are permanently stored on the target server—by sending a single HTTP request to the Shapes API endpoint. The stored JavaScript executes automatically in the browser of an administrator when they open the SP Page Builder editor. **Recommendations** Update SP Page Builder to version 6.7.0 or later.