Beaver Builder Plugin Starter Version
Monthly
Reflected XSS in Beaver Builder Plugin (Starter Version) for WordPress (all versions ≤2.11.0.1) permits unauthenticated attackers to inject arbitrary JavaScript via the unsanitized `no_results_message` parameter in the `node_preview` endpoint. Successful exploitation requires tricking a victim into clicking a crafted URL, after which the injected script executes in the victim's browser with access to session cookies, page DOM, and any credentials present in that context. No public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected XSS in Beaver Builder Plugin (Starter Version) for WordPress (all versions ≤2.11.0.1) permits unauthenticated attackers to inject arbitrary JavaScript via the unsanitized `no_results_message` parameter in the `node_preview` endpoint. Successful exploitation requires tricking a victim into clicking a crafted URL, after which the injected script executes in the victim's browser with access to session cookies, page DOM, and any credentials present in that context. No public exploit code or CISA KEV listing has been identified at time of analysis.