The Beaver Builder Page Builder plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of user-supplied input in the Button widget. Authenticated users with contributor-level permissions or above can inject arbitrary JavaScript code that is stored and executed in the context of users visiting the compromised pages. This vulnerability affects all plugin versions up to and including 2.8.4.2. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required at the contributor level, no user interaction needed, and impacts on confidentiality and integrity with no availability impact. No patch or official fix is currently documented.

Successful exploitation allows an attacker with contributor-level access or higher to inject persistent malicious scripts into pages via the Button widget. These scripts execute in the browsers of users who visit the infected pages, potentially leading to unauthorized actions or data disclosure limited to the confidentiality and integrity of user interactions within the affected site. There is no indication of availability impact or known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or avoiding use of the Button widget in Beaver Builder. Monitor official Beaver Builder and WordPress plugin repositories for updates addressing this vulnerability.