Beaver Builder Page Builder Drag And Drop Website Builder
Monthly
Arbitrary shortcode execution in Beaver Builder Page Builder for WordPress (all versions ≤2.10.3.1) allows unauthenticated remote attackers to invoke any registered WordPress shortcode via an insufficiently validated action handler that passes attacker-controlled input directly to do_shortcode(). Because shortcode impact depends on what handlers are registered in the environment, real-world consequences range from limited content disclosure or modification to chained exploitation through dangerous third-party shortcodes. No public exploit has been identified at time of analysis, and a patch was released as version 2.10.3.2.
Stored Cross-Site Scripting in Beaver Builder Page Builder for WordPress (all versions up to and including 2.10.2.2) allows authenticated users at Author level or above to permanently inject arbitrary JavaScript via the Button Module's Button Code field. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or drive-by malware delivery across the site's entire visitor population. No active exploitation is confirmed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified at the time of analysis.
Stored Cross-Site Scripting in Beaver Builder Page Builder plugin for WordPress up to version 2.10.1.1 allows authenticated attackers with author-level access or higher to inject arbitrary JavaScript through the 'settings[js]' parameter due to insufficient input sanitization and output escaping. When injected pages are accessed by other users, the malicious scripts execute in their browsers, potentially compromising site integrity and user accounts. No public exploit code or active CISA KEV status reported at analysis time.
Arbitrary shortcode execution in Beaver Builder Page Builder for WordPress (all versions ≤2.10.3.1) allows unauthenticated remote attackers to invoke any registered WordPress shortcode via an insufficiently validated action handler that passes attacker-controlled input directly to do_shortcode(). Because shortcode impact depends on what handlers are registered in the environment, real-world consequences range from limited content disclosure or modification to chained exploitation through dangerous third-party shortcodes. No public exploit has been identified at time of analysis, and a patch was released as version 2.10.3.2.
Stored Cross-Site Scripting in Beaver Builder Page Builder for WordPress (all versions up to and including 2.10.2.2) allows authenticated users at Author level or above to permanently inject arbitrary JavaScript via the Button Module's Button Code field. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or drive-by malware delivery across the site's entire visitor population. No active exploitation is confirmed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified at the time of analysis.
Stored Cross-Site Scripting in Beaver Builder Page Builder plugin for WordPress up to version 2.10.1.1 allows authenticated attackers with author-level access or higher to inject arbitrary JavaScript through the 'settings[js]' parameter due to insufficient input sanitization and output escaping. When injected pages are accessed by other users, the malicious scripts execute in their browsers, potentially compromising site integrity and user accounts. No public exploit code or active CISA KEV status reported at analysis time.