Skip to content
Noroxi

Beaver Builder Page Builder – Drag and Drop Website Builder

beaver-builder-lite-version · plugin

Known security vulnerabilities for Beaver Builder Page Builder – Drag and Drop Website Builder. Find out in seconds which version runs on your site with WP Lens.

30 known vulnerabilities

1 critical · latest Sep 8, 2026

Vulnerabilities

  • CVE-2022-36425

    WordPress Beaver Builder plugin <= 2.5.4.3 - Broken Access Control vulnerability

    Critical 9.8

  • CVE-2026-40744

    WordPress Beaver Builder plugin <= 2.10.1.2 - SQL Injection vulnerability

    High 8.5

  • CVE-2025-12934

    Beaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update

    High 8.1

  • CVE-2025-69319

    WordPress Beaver Builder plugin <= 2.9.4.1 - Arbitrary Code Execution vulnerability

    High 7.5

  • CVE-2026-18021

    Beaver Builder Page Builder <= 2.10.3.1 - Unauthenticated Arbitrary Shortcode Execution

    Medium 6.5

  • CVE-2026-17090

    Beaver Builder Page Builder <= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter

    Medium 6.4

  • CVE-2026-1231

    Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Globa

    Medium 6.4

  • CVE-2025-8897

    Beaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site Scripting

    Medium 6.1

  • CVE-2024-43926

    WordPress Beaver Builder plugin <= 2.8.3.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Medium 6.1

  • CVE-2024-1038

    Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Reflected (DOM-Based) Cross-Site Scripting

    Medium 6.1

  • CVE-2024-11832

    Beaver Builder – WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-53797

    WordPress Beaver Builder plugin <= 2.8.4.3 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-9505

    Beaver Builder – WordPress Page Builder <= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget

    Medium 5.4

  • CVE-2024-9049

    Beaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module

    Medium 5.4

  • CVE-2024-7895

    Beaver Builder (Lite Version) <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter

    Medium 5.4

  • CVE-2024-37500

    WordPress Beaver Builder plugin <= 2.8.2.2 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-4430

    Beaver Builder <= 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photo widget crop attribute

    Medium 5.4

  • CVE-2024-3923

    Beaver Builder – WordPress Page Builder <= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-2925

    Beaver Builder – WordPress Page Builder <= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button

    Medium 5.4

  • CVE-2024-30425

    WordPress Beaver Builder plugin <= 2.7.4.4 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-1080

    Beaver Builder – WordPress Page Builder <= 2.7.4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via heading tag

    Medium 5.4

  • CVE-2024-1074

    Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Audio Widget

    Medium 5.4

  • CVE-2024-0897

    Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-0896

    Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-0871

    Beaver Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget

    Medium 5.4

  • CVE-2023-50889

    WordPress Beaver Builder Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)

    Medium 5.4

  • CVE-2024-50430

    WordPress Beaver Builder plugin <= 2.8.3.7 - Cross Site Scripting (XSS) vulnerability

    Medium 4.8

  • CVE-2025-12558

    Beaver Builder – WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure

    Medium 4.3

  • CVE-2025-12782

    Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering

    Medium 4.3

  • CVE-2025-11726

    Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification

    Medium 4.3

← Back to directory