CVE-2024-0897

Beaver Builder – WordPress Page Builder (WordPress plugin) contains a stored XSS in the image URL parameter affecting all versions up to 2.7.4.2. Exploitation requires authenticated access (Contributor+) to inject scripts that run for any user visiting the injected page. Remediation: update to ve...

CVE-2023-50889

CVE-2023-50889 affects Beaver Builder – WordPress Page Builder (Beaver Builder Lite) up to version 2.7.2. Description indicates Stored Cross-Site Scripting (XSS) due to improper input neutralization during web page generation. Root cause per public record: failure to sanitize user-supplied input ...

CVE-2024-0896

The Beaver Builder – WordPress Page Builder plugin for WordPress has a Stored Cross-Site Scripting vulnerability in all versions up to and including 2.7.4.2, due to insufficient input sanitization and output escaping in the button link parameter. Authenticated attackers with contributor access or...

CVE-2024-1038

The CVE-2024-1038 entry concerns Beaver Builder – WordPress Page Builder for WordPress with a DOM-Based Reflected Cross-Site Scripting vulnerability. Affected versions are up to 2.7.4.2, due to insufficient input sanitization and output escaping in the playground.wordpress.net parameter, enabling...

CVE-2024-0871

The CVE-2024-0871 entry concerns Beaver Builder – WordPress Page Builder. A Stored Cross-Site Scripting (XSS) vulnerability exists in the Icon Widget via fl_builder_data[node_preview][link] and fl_builder_data[settings][link_target] parameters in all versions up to 2.7.4.2, caused by insufficient...

CVE-2024-1074

The CVE-2024-1074 entry concerns Beaver Builder – WordPress Page Builder. It describes a Stored Cross-Site Scripting (XSS) vulnerability in the audio widget’s link_url parameter, affecting all versions up to and including 2.7.4.2. Exploitation requires authentication with contributor access or hi...

CVE-2024-30425

CVE-2024-30425 affects the WordPress Beaver Builder plugin (Beaver Builder) up to version 2.7.4.4. The issue is a stored cross-site scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. In practical terms, this means attacker-supplied input could be ...

CVE-2024-2925

The CVE CVE-2024-2925 affects Beaver Builder – WordPress Page Builder (WordPress plugin) up to version 2.8.0.5. Root cause: insufficient input sanitization and output escaping on Button Widget attributes, enabling Stored Cross-Site Scripting. Impact: authenticated attackers with contributor-level...

CVE-2022-2716

The CVE-2022-2716 entry concerns Beaver Builder – WordPress Page Builder. Affected: Beaver Builder (WordPress plugin) versions up to and including 2.5.5.2. Issue: Stored Cross-Site Scripting via the Text Editor block caused by insufficient input sanitization and output escaping. Impact: Authentic...

CVE-2024-9505

CVE-2024-9505 affects Beaver Builder – WordPress Page Builder (Plugin). The issue is a stored DOM-based XSS in the Button widget introduced by insufficient input sanitization and output escaping on user-supplied attributes, exploitable by authenticated attackers with contributor-level access and ...

CVE-2022-36425

CVE-2022-36425 describes a Broken Access Control issue in the Beaver Builder WordPress plugin, affecting versions

CVE-2022-2695

Beaver Builder – WordPress Page Builder (WordPress) is affected by a Stored XSS in the caption parameter added to images via the media uploader, affecting versions up to and including 2.5.5.2. Root cause: insufficient input sanitization and output escaping. Impact: authenticated attackers with Be...

CVE-2024-9049

CVE-2024-9049 — Beaver Builder for WordPress: Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via the Button Group Module in versions up to 2.8.3.6. Root cause: insufficient input sanitization and output escaping on user-supplied attributes in the Button Group. Impact: stored X...

CVE-2022-2934

The CVE-2022-2934 entry concerns the Beaver Builder – WordPress Page Builder for WordPress. Versions up to and including 2.5.5.2 are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Media block via the Image URL field, caused by insufficient input sanitization and output escap...

CVE-2024-50430

CVE-2024-50430 is a stored XSS vulnerability in the WordPress Beaver Builder plugin, affecting Beaver Builder versions up to 2.8.3.7. The issue is described as improper neutralization of input during web page generation, enabling Stored XSS. Public references in Patchstack indicate a fix in versi...

CVE-2024-1080

CVE-2024-1080 affects the Beaver Builder – WordPress Page Builder plugin for WordPress, with vulnerable versions listed as up to 2.7.4.4. The flaw is Stored Cross-Site Scripting (XSS) in the Heading tag due to insufficient input sanitization and output escaping. Exploitation requires authenticate...

CVE-2024-53797

CVE-2024-53797 is a Stored XSS in WordPress Beaver Builder (The Beaver Builder Team)

CVE-2024-43926

Beaver Builder vulnerability CVE-2024-43926 is a Reflected XSS in Beaver Builder (Lite) <= 2.8.3.2. The Beaver Builder page builder, used in WordPress sites, is affected by improper neutralization of input during web page generation, enabling reflected XSS. The Wordfence vulnerability entry no...

CVE-2022-2517

The Beaver Builder – WordPress Page Builder for WordPress is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Caption - On Hover field of images, in versions up to and including 2.5.5.2. Root cause: insufficient input sanitization and output escaping. Impact: authenticated att...

CVE-2024-11832

CVE-2024-11832 affects Beaver Builder – WordPress Page Builder (WordPress plugin). The vulnerability is a Stored Cross-Site Scripting (XSS) via the custom JavaScript row settings, caused by insufficient input sanitization and output escaping in all versions up to 2.8.4.4. It requires authenticati...

CVE-2024-7895

The CVE-2024-7895 entry corresponds to Beaver Builder – WordPress Page Builder and is corroborated by connected records. Red Hat’s CVE-2024-7895 entry describes a Stored Cross-Site Scripting flaw in Beaver Builder Lite (WordPress plugin) affecting all versions up to and including 2.8.3.5, trigger...

CVE-2024-37500

CVE-2024-37500 : Beaver Builder for WordPress (Beaver Builder – WordPress Page Builder) contains an Improper Neutralization of Input During Web Page Generation leading to Stored XSS in versions up to 2.8.2.2 (affecting Beaver Builder: from n/a through 2.8.2.2). The issue is caused by insufficient...

CVE-2021-42748

CVE-2021-42748 affects Beaver Builder up to version 2.5.0.3. The issue allows attackers to bypass the visibility controls protection mechanism via the REST API, enabling unauthorized exposure of content. The vulnerability’s root cause is a bypass of visibility controls in REST API handling, with ...

CVE-2024-4430

CVE-2024-4430 affects Beaver Builder – WordPress Page Builder. Vulnerable in all versions up to and including 2.8.1.2 via the photo widget crop attribute due to insufficient input sanitization/output escaping. Exploitation requires at least contributor (or higher) privileges and user interaction;...

CVE-2025-4102

The Beaver Builder Plugin (Starter Version) for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the save_enabled_icons function in all versions up to and including 2.9.1. An authenticated attacker with Administrator-level access can upload arbitrary files ...

CVE-2024-3923

Technical details about CVE-2024-3923 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories to obtain affected versions, impact, and fixes.

CVE-2025-8897

CVE-2025-8897 documents a Reflected Cross-Site Scripting vulnerability in Beaver Builder – WordPress Page Builder (Lite) versions up to 2.9.2.1. The issue arises from insufficient input sanitization and output escaping in the fl_builder parameter, enabling an unauthenticated attacker to inject sc...

CVE-2025-8427

Beaver Builder Plugin (Starter Version) for WordPress (

CVE-2025-11726

CVE-2025-11726 affects Beaver Builder – WordPress Page Builder (

CVE-2025-12558

CVE-2025-12558 (Beaver Builder – WordPress Page Builder) exposes sensitive information via the get_attachment_sizes function. All versions up to and including 2.9.4 are affected. Exploitation requires authentication at Contributor level or higher, enabling an attacker to extract the path and meta...

CVE-2025-12782

Beaver Builder – WordPress Page Builder (Beaver Builder Lite) is affected by CVE-2025-12782 due to an authorization bypass in the disable() path that fails to properly verify user permissions. The issue affects all versions up to 2.9.4, enabling authenticated users with at least Contributor acces...