The Beaver Builder Page Builder plugin for WordPress contains a stored XSS vulnerability (CVE-2026-1231) due to improper neutralization of input in the 'js' Global Settings parameter. This occurs because the save_global_settings() function lacks proper capability checks and fails to sanitize and escape input adequately. As a result, authenticated users with certain access privileges can inject malicious scripts that persist and execute in the context of other users viewing the affected pages. The vulnerability affects all versions up to 2.10.0.5 and has a CVSS 3.1 base score of 6.4 (medium severity). No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation allows authenticated users with Custom-level access or higher and Beaver Builder access to inject persistent malicious scripts into pages. These scripts execute in the browsers of users who view the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability does not impact availability but affects confidentiality and integrity to a limited extent. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Beaver Builder access to trusted users only and monitor for suspicious activity related to global settings changes. Avoid granting Custom-level or higher access unnecessarily. Follow updates from the Beaver Builder vendor for official patches or workarounds.