The Beaver Builder Plugin (Starter Version) contains a stored cross‑site scripting flaw triggered through the auto_play parameter. The vulnerability arises from insufficient input sanitization and output escaping, allowing an authenticated user with Contributor or higher privileges to embed arbitrary JavaScript in a page that is then rendered for every visitor who views that page.

All editions of the Beaver Builder Plugin (Starter Version) for WordPress, including every release up to and including version 2.9.2.1, are affected. The flaw is documented by The Beaver Builder Team and listed in the vendor’s changelog.

The flaw has a CVSS score of 6.4, indicating moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not present in CISA’s KEV catalog. An attacker must first authenticate with Contributor-level or higher access; once authenticated, the attacker can store a malicious payload in the auto_play setting of a page, which will execute in the browsers of anyone who visits that page.