The Beaver Builder Page Builder plugin for WordPress suffers from a DOM-Based Reflected XSS vulnerability due to improper neutralization of input during web page generation. Specifically, the 'playground.wordpress.net' parameter is not properly sanitized or escaped, allowing injection of arbitrary web scripts. This affects all versions up to and including 2.7.4.2. The vulnerability requires user interaction (clicking a malicious link) and does not require authentication. The CVSS 3.1 base score is 5.4, indicating medium severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session when the victim clicks a crafted link. This can lead to information disclosure or manipulation of web content as perceived by the user. There is no indication of impact on system availability. The vulnerability does not require authentication, increasing its risk profile. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links involving the affected parameter and consider disabling or restricting the use of the vulnerable plugin. Monitor official Beaver Builder communications for updates on patches or mitigations.