The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress contains insufficient input sanitization and output escaping for the 'settings[js]' parameter. This flaw allows an authenticated attacker with author-level privileges to inject arbitrary JavaScript code that is stored server‑side and executed in each visitor’s browser when they load the affected page. The injected scripts can be used to steal session data, deface the site, or run additional malicious payloads, thereby compromising user confidentiality and integrity.

All WordPress sites that are running Beaver Builder Page Builder – Drag and Drop Website Builder versions 2.10.1.1 and earlier are potentially affected. The vulnerability applies to the plugin’s drag‑and‑drop page editor where authors can modify page settings, and any site that has not yet upgraded to a patched release.

The score of 6.4 places the vulnerability in the medium severity range. The exploit requires the attacker to be authenticated as an author or higher and to possess the ability to edit page settings. Once the malicious script is stored, it is automatically delivered to any visitor of the vulnerable page, making it an easily exploitable threat for sites that rely on the upgraded author role. The vulnerability is not yet listed in the CISA KEV catalog, and there is no EPSS value available to gauge the current exploitation probability.