CVE-2022-2695: Improper Neutralization of Input During Web Page Generation

The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter added to images via the media uploader in versions up to, and including, 2.5.5.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

WordPress plugin Beaver Builder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Beaver Builder – WordPress Page Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Beaver Builder - A...

WordPress plugin Beaver Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Beaver Builder - A...

PT-2022-23362 · WordPress · Beaver Builder

Name of the Vulnerable Software and Affected Versions: Beaver Builder plugin versions = 2.5.4.3 Description: The issue is related to a Broken Access Control vulnerability. Recommendations: For Beaver Builder plugin versions = 2.5.4.3, update to a version higher than 2.5.4.3 to resolve the issue...

WordPress Beaver Builder plugin <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability via caption

Authenticated Stored Cross-Site Scripting XSS vulnerability via caption discovered by Zhouyuan Yang in WordPress Beaver Builder plugin versions = 2.5.5.2. Solution Update the WordPress Beaver Builder plugin to the latest available version at least 2.5.5.3...

Beaver Builder < 2.5.5.3 - Authenticated Stored XSS via Caption

The plugin does not sanitise and escape the caption parameter added to images via the media uploader, which could allow users with access to the plugin's editor to perform Cross-Site Scripting attacks...

Beaver Builder < 2.5.5.3 - Authenticated Stored XSS via Caption On Hover

The plugin does not sanitise and escape the Caption On Hover field of images, which could allow users with access to the plugin's editor to perform Cross-Site Scripting attacks...

WordPress Beaver Builder plugin <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability via Caption On Hover

Authenticated Stored Cross-Site Scripting XSS vulnerability via Caption On Hover discovered by Zhouyuan Yang in WordPress Beaver Builder plugin versions = 2.5.5.2. Solution Update the WordPress Beaver Builder plugin to the latest available version at least 2.5.5.3...

Beaver Builder < 2.5.5.3 - Authenticated Stored XSS via Text Editor

The plugin does not sanitise and escape the Text Editor block, which could allow users with access to the plugin's editor to perform Cross-Site Scripting attacks...

WordPress Beaver Builder plugin <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability via Image URL

Authenticated Stored Cross-Site Scripting XSS vulnerability via Image URL discovered by Zhouyuan Yang in WordPress Beaver Builder plugin versions = 2.5.5.2. Solution Update the WordPress Beaver Builder plugin to the latest available version at least 2.5.5.3...

Beaver Builder < 2.5.5.3 - Authenticated Stored XSS via Image URL

The plugin does not sanitise and escape the Image URL field of the Media block, which could allow users with access to the plugin's editor to perform Cross-Site Scripting attacks...

WordPress Beaver Builder plugin <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability via Text Editor

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Zhouyuan Yang in WordPress Beaver Builder plugin versions = 2.5.5.2. Solution Update the WordPress Beaver Builder plugin to the latest available version at least 2.5.5.3...

WordPress Beaver Builder plugin <= 2.5.4.3 - Broken Access Control vulnerability

Broken Access Control vulnerability leading to the shutdown of the page builder discovered by Dave Jong Patchstack in WordPress Beaver Builder plugin versions = 2.5.4.3. Solution Update the WordPress Beaver Builder plugin to the latest available version at least 2.5.4.4...

Beaver Builder < 2.5.4.4 - Subscriber+ Arbitrary Post Builder Layout Disabling

The plugin does not have authorisation and CSRF checks in the flbuilderdisable AJAX action, which could allow any authenticated users, such as subscriber to disable the builder layout of arbitrary posts Note: The original advisory mentions the issue has been fixed, however only a CSRF check has...

WordPress Sales Page Addon – Elementor & Beaver Builder plugin < 1.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Sales Page Addon – Elementor & Beaver Builder plugin versions 1.3. Solution Update the WordPress Sales Page Addon – Elementor & Beaver Builder plugin to the latest available version at least 1.3...

WordPress Sales Page Addon – Elementor & Beaver Builder plugin < 1.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Sales Page Addon – Elementor & Beaver Builder plugin versions 1.3. Solution Update the WordPress Sales Page Addon – Elementor & Beaver Builder plugin to the latest available version at least 1.3...

WordPress Livemesh Addons for Beaver Builder plugin <= 2.8.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Livemesh Addons for Beaver Builder plugin versions = 2.8.3. Solution Update the WordPress Livemesh Addons for Beaver Builder plugin to the latest available version at least 2.8.4...

WordPress Livemesh Addons for Beaver Builder plugin <= 2.8.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Livemesh Addons for Beaver Builder plugin versions = 2.8.3. Solution Update the WordPress Livemesh Addons for Beaver Builder plugin to the latest available version at least 2.8.4...

WordPress PowerPack Lite for Beaver Builder plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of the WordPress PowerPack Lite for Beaver Builder plugin...