The Beaver Builder Page Builder plugin for WordPress contains a stored XSS vulnerability (CWE-79) via the 'type' parameter due to improper input neutralization during page generation. Authenticated users with Contributor or higher privileges can inject arbitrary JavaScript that executes in the context of users visiting the compromised page. This vulnerability affects all versions up to and including 2.8.3.5. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official fix details are currently available.

Successful exploitation allows an authenticated user with Contributor-level or higher access to inject persistent malicious scripts into pages. These scripts execute in the browsers of users who view the infected pages, potentially leading to unauthorized actions or data disclosure limited to the scope of the injected scripts. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level and higher user privileges to trusted users only. Consider applying additional hardening such as web application firewall (WAF) rules to detect and block malicious input targeting the 'type' parameter. Monitor for updates from Beaver Builder regarding patches or official mitigations.