Beaver Builder CVE-2025-8427

Exploitation requires an authenticated WordPress account with Contributor-level privileges or higher (per CVSS PR:L) on a site running Beaver Builder Lite/Starter version 2.9.2.1 or earlier, and the attacker must be able to supply input through the 'auto_play' parameter of a Beaver Builder module. Execution is gated by user interaction (UI:R): the stored payload only fires when another user - ideally a higher-privileged admin - accesses the injected page. This limits realistic impact to multi-user/multi-author sites where untrusted Contributor accounts exist; single-admin installations where no lower-trust accounts are provisioned face negligible practical risk. The free Lite edition is the affected build; the commercial/premium editions are not referenced in the provided CPE.

This is a genuine but low-to-moderate priority issue, not a top-tier emergency. The CVSS 3.1 base score of 5.4 (Medium) is driven by AV:N/AC:L but tempered by PR:L (requires at least Contributor-level WordPress authentication) and UI:R (a victim must view the injected page); the S:C scope change and C:L/I:L reflect script execution in another user's browser context rather than direct server compromise. Exploitation signals are consistently low: EPSS is 0.18% (6th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data - no public exploit identified at time of analysis. The signals do NOT conflict; they align toward a real-but-not-urgent stored XSS requiring an authenticated foothold. The key limiting factor is the trust prerequisite: an attacker must already hold a Contributor (or higher) account, so this is primarily a privilege-escalation/lateral-movement risk on multi-author sites rather than a mass-exploitable unauthenticated flaw. Note the data was reported by Wordfence (security@wordfence.com), a credible WordPress-focused source, which lends confidence to the vulnerability's validity even though no vendor advisory text is included.

On a multi-author WordPress site, an attacker holding a Contributor-level account edits content using the Beaver Builder (Lite/Starter) module and injects a malicious script via the 'auto_play' parameter, which is stored without sufficient sanitization. When an administrator or another logged-in user later previews or opens that page, the script executes in their browser session, potentially stealing session cookies or performing actions as that higher-privileged user. No public proof-of-concept was provided, so the attack is plausible from the description but not demonstrated in the supplied data.