WordPress Ultimate Addons for Beaver Builder - Lite plugin <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget vulnerability

🗓️ 02 Feb 2026 19:38:00Reported by Francesco CarlucciType

Stored XSS via Heading Widget in WordPress Ultimate Addons for Beaver Builder Lite <=1.5.7 by authenticated contributors.

Reporter	Title	Published	Views	Family All 10
CNNVD	WordPress Plugin Ultimate Addons for Beaver Builder 安全漏洞	30 Mar 202400:00	–	cnnvd
CVE	CVE-2024-2143	30 Mar 202406:44	–	cve
Cvelist	CVE-2024-2143 Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget	30 Mar 202406:44	–	cvelist
EUVD	EUVD-2024-27107	3 Oct 202520:07	–	euvd
NVD	CVE-2024-2143	30 Mar 202407:15	–	nvd
Positive Technologies	PT-2024-18873 · WordPress · Ultimate Addons For Beaver Builder – Lite	30 Mar 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-2143	7 Jan 202609:13	–	redhatcve
Vulnrichment	CVE-2024-2143 Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget	30 Mar 202406:44	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (March 25, 2024 to March 31, 2024)	4 Apr 202417:35	–	wordfence
WPVulnDB	Ultimate Addons for Beaver Builder – Lite < 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget	29 Mar 202400:00	–	wpvulndb

Vulners

Node

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ultimate-addons-for-beaver-builder-lite/ultimate-addons-for-beaver-builder-lite-157-authenticated-contributor-stored-cross-site-scripting-via-heading-widget

02 Feb 2026 19:38Current

8.3High risk

Vulners AI Score8.3

CVSS 3.15.4 - 6.4

EPSS0.00134

SSVC