WordPress Beaver Builder CVE-2026-92084 shortcode execution

CVE-2026-92084 Beaver Builder Lite = 2.11.0.5: posts a comment whose author name contains a registered shortcode; if the builder page Sidebar module renders Recent Comments, doshortcode executes the payload on page render. Requires comment approval auto-approve or moderator. Lab marker shortcode...

WordPress Beaver Builder CVE-2026-92084 detect

Detects Beaver Builder Lite = 2.11.0.5 CVE-2026-92084: Sidebar module widget output may execute registered shortcodes via layout-wide doshortcode. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Beaver Builder Lite CVE-2026-92084 exposure.""" from kittysploit import from...

CVE-2026-110897

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1...

EUVD-2026-103425

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1...

CVE-2026-110897

The PowerPack Lite for Beaver Builder WordPress plugin (affected versions through 1.3.1 ) contains an Improper Neutralization of Input During Web Page Generation vulnerability. This flaw leads to Stored Cross-Site Scripting (XSS) , which can be triggered when the application fails to properly san...

CVE-2026-110897 WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1...

CVE-2026-110897 WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1...

CVE-2026-110897: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1...

PT-2026-116600

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1...

WordPress PowerPack Lite for Beaver Builder Cross-site Scripting Vulnerability

WordPress PowerPack Lite for Beaver Builder 1.3.1 and earlier versions have a cross-site scripting vulnerability. This vulnerability arises from improper input during web page generation, and could lead to storage-based cross-site scripting attacks...

WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Tang in WordPress Plugin PowerPack Lite for Beaver Builder versions = 1.3.1...

Exploit for CVE-2026-92084

CVE-2026-92084 - Beaver Builder Arbitrary Shortcode Execution...

CVE-2026-92084

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

CVE-2026-92084 Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

CVE-2026-92084

The Beaver Builder Page Builder plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution in all versions up to and including 2.11.0.5 . The root cause is the software's failure to properly validate a value before executing the do_shortcode function. This vulnerability c...

CVE-2026-92084 Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

EUVD-2026-91966

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

CVE-2026-95865

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2026-95865 Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2026-95865

The Beaver Builder Page Builder plugin for WordPress is vulnerable to blind SQL Injection in all versions up to and including 2.11.0.5 . The root cause is insufficient escaping of the fields[][value] parameter and a lack of sufficient preparation on the existing SQL query. Authenticated attackers...