What’s Vulnerable › Products
beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder vulnerabilities
41 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.
Latest beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder vulnerabilities
- CVE-2026-92084 — Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output (CVSS 9.1)
- CVE-2026-95865 — Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter (CVSS 6.5)
- CVE-2026-18021 — Beaver Builder Page Builder <= 2.10.3.1 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5)
- CVE-2026-18843 — Beaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter (CVSS 6.1)
- CVE-2026-17090 — Beaver Builder Page Builder <= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter (CVSS 6.4)
- CVE-2026-40744 — WordPress Beaver Builder plugin <= 2.10.1.2 - SQL Injection vulnerability (CVSS 8.5)
- CVE-2026-2481 — Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]' (CVSS 6.4)
- CVE-2026-1231 — Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings (CVSS 6.4)
- CVE-2025-69319 — WordPress Beaver Builder plugin <= 2.9.4.1 - Arbitrary Code Execution vulnerability (CVSS 7.5)
- CVE-2025-12934 — Beaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update (CVSS 8.1)
- CVE-2025-12558 — Beaver Builder – WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure (CVSS 4.3)
- CVE-2025-12782 — Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering (CVSS 4.3)
- CVE-2025-11726 — Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification (CVSS 4.3)
- CVE-2025-8427 — Beaver Builder Plugin (Starter Version) <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'auto_play' (CVSS 5.4)
- CVE-2025-8897 — Beaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site Scripting (CVSS 6.1)
- CVE-2025-4102 — Beaver Builder Plugin (Starter Version) <= 2.9.1 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2)
- CVE-2024-11832 — Beaver Builder – WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
- CVE-2024-53797 — WordPress Beaver Builder plugin <= 2.8.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
- CVE-2024-50430 — WordPress Beaver Builder plugin <= 2.8.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 4.8)
- CVE-2024-9505 — Beaver Builder – WordPress Page Builder <= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget (CVSS 5.4)
- CVE-2024-9049 — Beaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module (CVSS 5.4)
- CVE-2024-43926 — WordPress Beaver Builder plugin <= 2.8.3.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
- CVE-2024-7895 — Beaver Builder (Lite Version) <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter (CVSS 5.4)
- CVE-2024-37500 — WordPress Beaver Builder plugin <= 2.8.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
- CVE-2024-4430 — Beaver Builder <= 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photo widget crop attribute (CVSS 5.4)