The Beaver Builder Page Builder – Drag and Drop Website Builder plugin is vulnerable to stored XSS through the global settings field ‘js’. The flaw arises because the function that saves global settings performs no capability checks and does not properly sanitize or escape the input. As a result, an authenticated user with Custom‑level access or higher who has been granted Beaver Builder permissions can inject arbitrary JavaScript. Once stored, the script executes whenever any visitor loads a page that includes the affected global settings, enabling attackers to deface pages, steal credentials, or conduct further attacks against site users.

WordPress sites running the Beaver Builder Page Builder – Drag and Drop Website Builder plugin, versions 2.10.0.5 and earlier. The vulnerability affects all installations that use the plugin with any Global Settings configuration.

The CVSS score of 6.4 indicates moderate severity, but the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers need an authenticated account with Custom‑level or higher access, and the ability to edit Beaver Builder Global Settings, to exploit the stored XSS. No additional conditions are reported; the flaw can be triggered solely by submitting a malicious payload to the ‘js’ field through the normal settings interface.