The Beaver Builder Page Builder plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in its Icon Widget parameters. Specifically, the parameters 'fl_builder_data[node_preview][link]' and 'fl_builder_data[settings][link_target]' do not properly sanitize or escape user input before rendering it on web pages. This allows authenticated users with contributor-level permissions or higher to inject arbitrary JavaScript code that will execute in the context of any user viewing the compromised page. The vulnerability affects all versions up to and including 2.7.4.2. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges and user interaction. No patch or official fix details are currently available.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via vulnerable widget parameters. These scripts execute in the browsers of users who visit the infected pages, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability does not affect availability and requires user interaction to trigger. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the Icon Widget parameters mentioned. Monitor for updates from the Beaver Builder vendor or WordPress plugin repository for patches addressing this vulnerability.