EUVD-2026-58856
GHSA-rgr5-cvrq-4ccg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L reflects required Author-level authentication; S:C, C:L, and I:L capture the persistent cross-browser XSS impact on victim sessions beyond the injecting user's scope.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Beaver Builder Page Builder - Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Button Module 'button' (Button Code) Setting in all versions up to, and including, 2.10.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Beaver Builder grants editor access to any WordPress role holding the edit_posts capability by default, meaning Author-level users and above can exploit this vulnerability.
AnalysisAI
Stored Cross-Site Scripting in Beaver Builder Page Builder for WordPress (all versions up to and including 2.10.2.2) allows authenticated users at Author level or above to permanently inject arbitrary JavaScript via the Button Module's Button Code field. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or drive-by malware delivery across the site's entire visitor population. No active exploitation is confirmed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified at the time of analysis.
Technical ContextAI
The vulnerability exists in the Beaver Builder drag-and-drop page builder plugin for WordPress (CPE: cpe:2.3:a:beaverbuilder:beaver_builder_page_builder_-_drag_and_drop_website_builder). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a failure to sanitize and escape user-supplied input in the Button Module's Button Code setting before rendering it in page output. Code references in the WordPress plugin trac repository pinpoint the flaw across three files in versions 2.10.1.5 and 2.10.2.2: modules/button/includes/frontend.js.php (line 8), modules/button/button.php (line 341), and classes/class-fl-builder-model.php (line 4659). This indicates that the model layer accepts an unvalidated code string and the frontend PHP template renders it directly into page markup without escaping, making the stored payload persistent and browser-executable.
RemediationAI
Update the Beaver Builder Page Builder plugin to a version beyond 2.10.2.2 immediately. The upstream fix is referenced via WordPress plugin trac changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3645274%40beaver-builder-lite-version&new=3645274%40beaver-builder-lite-version; however, the exact patched release version number is not independently confirmed from available intelligence data - administrators should verify the current plugin version in the official WordPress plugin repository before updating and cross-reference against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0abbdf2c-b1f8-4431-b892-1d7972749af6. As a compensating control prior to patching, administrators can restrict the edit_posts capability to only fully trusted roles (Editor, Administrator), removing it from Author-level users - note this alters the default WordPress role model and may disrupt established editorial workflows. If the Button Module is not operationally required, disabling it within Beaver Builder's module management settings eliminates the attack surface without impacting other modules, though this may affect existing page layouts using button elements.
Arbitrary shortcode execution in Beaver Builder Page Builder for WordPress (all versions ≤2.10.3.1) allows unauthenticat
Stored Cross-Site Scripting in Beaver Builder Page Builder plugin for WordPress up to version 2.10.1.1 allows authentica
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today