The Beaver Builder Page Builder plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in the audio widget's 'link_url' parameter. This flaw allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript code into pages. The vulnerability exists due to inadequate sanitization and escaping of user input before rendering on the page. When a user accesses a page containing the injected script, the malicious code executes in their browser context, potentially leading to session hijacking or other script-based attacks. The issue affects all versions up to and including 2.7.4.2. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and partial confidentiality and integrity impact. No official patch or vendor advisory is currently available, and no known exploitation has been reported.

An attacker with contributor or higher privileges can inject persistent malicious scripts into pages via the audio widget's 'link_url' parameter. These scripts execute in the context of users who view the compromised pages, potentially leading to unauthorized actions such as session hijacking or data theft. The vulnerability impacts confidentiality and integrity but does not affect availability. Since exploitation requires authenticated access, the risk is limited to environments where such user roles exist.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor and higher privileges to trusted users only. Consider disabling or limiting use of the audio widget if feasible. Monitor plugin updates from Beaver Builder for a security patch addressing this vulnerability.