The Beaver Builder Page Builder plugin for WordPress is vulnerable to reflected XSS via the 'fl_builder' parameter due to improper neutralization of input during web page generation. This allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser if the victim interacts with a crafted link. The issue affects all versions up to and including 2.9.2.1. There is no vendor advisory or patch information provided in the data, and no known exploits in the wild have been reported.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of session cookies, defacement, or other actions limited by the browser's security model. The vulnerability does not impact availability and requires user interaction. The CVSS score of 6.1 reflects a medium impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links involving the 'fl_builder' parameter and consider disabling or restricting access to the affected plugin. Monitor the vendor's website or trusted security sources for updates or patches addressing this vulnerability.