The WPZOOM Addons for Beaver Builder plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in its Testimonials widget. Authenticated users with contributor or higher privileges can inject arbitrary JavaScript code due to improper input validation and output escaping. This malicious code executes in the context of users visiting the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 1.3.4. There is no indication of an official patch or fix at this time.

An attacker with contributor-level access or above can exploit this vulnerability to inject persistent malicious scripts into pages via the Testimonials widget. These scripts execute in the browsers of users who visit the injected pages, potentially leading to information disclosure or session compromise. The vulnerability does not affect availability and requires authenticated access, limiting the attack surface. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Testimonials widget if possible to reduce exposure.