Malicious code in xo-beaver (npm)

The package xo-beaver was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security f47822e91a268b85634963cc1c620bf45c186418ab782e91759b54cb3585ad44 This package installs a dependency hosted on a custom domain that runs an info...

MAL-2025-15557 Malicious code in beaver-logger-paypal (npm)

The package beaver-logger-paypal was found to contain malicious code...

WordPress Supreme Addons for Beaver Builder Cross-Site Scripting Vulnerability

WordPress Supreme Addons for Beaver Builder is a plugin that extends the functionality of the Beaver Builder page builder, mainly for enhancing its visual editing capabilities and module extensions. A cross-site scripting vulnerability exists in WordPress Supreme Addons for Beaver Builder, which...

CVE-2025-3669

The Supreme Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's autoqrcodesabb shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-3669

The CVE-2025-3669 entry concerns the WordPress plugin Supreme Addons for Beaver Builder. A Stored Cross-Site Scripting vulnerability exists in the auto_qrcodesabb shortcode due to insufficient input sanitization and output escaping on user-supplied attributes, affecting all versions up to 1.0.9. ...

PT-2025-30642 · Unknown +1 · Beaver Builder +1

Name of the Vulnerable Software and Affected Versions: Supreme Addons for Beaver Builder plugin for WordPress versions up to and including 1.0.9 Description: The Supreme Addons for Beaver Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting through the auto qrcodesabb...

WordPress plugin Supreme Addons for Beaver Builder 跨站脚本漏洞

WordPress Supreme Addons for Beaver Builder is a plugin that extends the functionality of the Beaver Builder page builder, mainly for enhancing its visual editing capabilities and module extensions. A cross-site scripting vulnerability exists in WordPress Supreme Addons for Beaver Builder, which...

WordPress Beaver Builder plugin code issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A code issue vulnerability exists in the WordPress Beaver Builder plugin that stems from a lack of file type validation, which can be exploited by an attacker to cause an...

CVE-2025-4102

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveenabledicons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level...

CVE-2025-4102

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveenabledicons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level...

CVE-2025-4102

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveenabledicons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level...

CVE-2025-4102 Beaver Builder Plugin (Starter Version) <= 2.9.1 - Authenticated (Administrator+) Arbitrary File Upload

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveenabledicons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level...

CVE-2025-4102 Beaver Builder Plugin (Starter Version) <= 2.9.1 - Authenticated (Administrator+) Arbitrary File Upload

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveenabledicons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level...

CVE-2025-4102

The Beaver Builder Plugin (Starter Version) for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the save_enabled_icons function in all versions up to and including 2.9.1. An authenticated attacker with Administrator-level access can upload arbitrary files ...

WordPress plugin Beaver Builder Plugin 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A code issue vulnerability exists in the WordPress Beaver Builder plugin that stems from a lack of file type validation, which can be exploited by an attacker to cause an...

CVE-2024-43151

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder – Lite allows Stored XSS.This issue affects Ultimate Addons for Beaver Builder – Lite: from n/a through 1.5.9...

CVE-2024-9049

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Group module in all versions up to, and including, 2.8.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-2185

The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Box widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-0897

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image URL parameter in all versions up to, and including, 2.7.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-7895

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.8.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...