The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to reflected cross‑site scripting through the 'fl_builder' GET parameter. In all versions up to and including 2.9.2.1 the plugin does not properly sanitize or escape user‑supplied input, allowing an attacker to embed arbitrary JavaScript that will run in the context of a victim’s browser when the victim follows a crafted link or clicks a malicious button. This flaw can lead to theft of session cookies, defacement of content, or execution of additional malicious code on the victim’s machine.

Vulnerable systems are installations of the Beaver Builder Lite Page Builder – Drag and Drop Website Builder for WordPress. Versions 2.9.2.1 and older are affected; any deployment of the plugin without an update beyond this release is at risk. The vulnerability is tied to the plugin’s core code and not to the underlying WordPress platform itself.

The CVSS score of 6.1 places the weakness in the moderate severity range, but the EPSS score of less than 1% indicates that it is currently not widely exploited. The flaw is remote, unauthenticated, and does not require any prior access; an attacker only needs to lure a user to a URL containing a malicious 'fl_builder' value. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread active exploitation as of now. Nonetheless, the impact to a business that relies on the plugin is high if an attacker succeeds in compromising a user’s session or injecting malware through the site.