What is the CVSS score of EUVD-2026-20446?

EUVD-2026-20446 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-20446?

Yes, a patch is available for EUVD-2026-20446. Update the affected software to the latest version immediately.

WordPress EUVD-2026-20446

| CVE-2026-2481 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Wordfence

GHSA-237f-mxrr-mcvr

GHSA-2rr6-9w84-3v7p

GHSA-3jw7-fx6j-pr6g

GHSA-3qgq-r69m-f2f7

GHSA-444m-px7r-qpvv

GHSA-6x36-5hv7-6j2r

GHSA-f5w7-wwr4-x5v8

GHSA-fm67-x2fw-2g76

GHSA-mhvc-rf83-29wq

GHSA-w586-qrfw-4qhv

GHSA-w8rf-q6v7-c2h2

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 08, 2026 - 14:30 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 11:46 euvd

EUVD-2026-20446

Analysis Generated

Apr 08, 2026 - 11:46 vuln.today

CVE Published

Apr 08, 2026 - 11:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Beaver Builder Page Builder - Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'settings[js]' parameter in versions up to, and including, 2.10.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Beaver Builder Page Builder plugin for WordPress up to version 2.10.1.1 allows authenticated attackers with author-level access or higher to inject arbitrary JavaScript through the 'settings[js]' parameter due to insufficient input sanitization and output escaping. When injected pages are accessed by other users, the malicious scripts execute in their browsers, potentially compromising site integrity and user accounts. No public exploit code or active CISA KEV status reported at analysis time.

Technical ContextAI

Beaver Builder Page Builder is a WordPress plugin (CPE: cpe:2.3:a:beaverbuilder:beaver_builder_page_builder_-_drag_and_drop_website_builder) that provides drag-and-drop page building functionality. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting) in the 'settings[js]' parameter handling. The plugin fails to properly sanitize user input before storing it in the database and does not adequately escape output when rendering the stored data. This allows authenticated users to bypass input validation and inject JavaScript payloads that persist in the database and execute in the context of other users' browsers, particularly high-risk because it affects the page-building configuration layer where security controls may be weaker than in main content areas.

RemediationAI

Update Beaver Builder Page Builder plugin to a version newer than 2.10.1.1 where input sanitization and output escaping have been remediated. Site administrators should immediately patch the plugin via WordPress admin dashboard (Plugins > Updates) or by downloading the latest version from https://www.wpbeaverbuilder.com/change-logs/. As an interim measure before patching, restrict author-level and above access to users with demonstrable need, audit existing pages and templates for suspicious JavaScript in builder settings, and monitor user activity for unauthorized modifications. Review Wordfence's vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/5b15575f-0638-40ec-b152-20ba2225a725 for additional context and remediation guidance.