Skip to content
Noroxi

Beaver Builder Page Builder – Drag and Drop Website Builder

beaver-builder-lite-version · plugin

Known security vulnerabilities for Beaver Builder Page Builder – Drag and Drop Website Builder. Find out in seconds which version runs on your site with WP Lens.

30 known vulnerabilities

1 critical · 4 exploitable without logging in · latest Sep 8, 2026

Listed on wordpress.org · latest 2.11.0.6 · last updated Sep 25, 2026 · 100K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2022-36425login required≤ 2.5.4.3

    WordPress Beaver Builder plugin <= 2.5.4.3 - Broken Access Control vulnerability

    Critical 9.8

  • CVE-2026-40744login required≤ 2.10.1.2

    WordPress Beaver Builder plugin <= 2.10.1.2 - SQL Injection vulnerability

    High 8.5

  • CVE-2025-12934subscriber+≤ 2.9.4.1

    Beaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update

    High 8.1

  • CVE-2025-69319login required≤ 2.9.4.1

    WordPress Beaver Builder plugin <= 2.9.4.1 - Arbitrary Code Execution vulnerability

    High 7.5

  • CVE-2026-18021unauthenticated≤ 2.10.3.1

    Beaver Builder Page Builder <= 2.10.3.1 - Unauthenticated Arbitrary Shortcode Execution

    Medium 6.5

  • CVE-2026-1231login required≤ 2.10.0.5

    Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Globa

    Medium 6.4

  • CVE-2026-17090author+≤ 2.10.2.2

    Beaver Builder Page Builder <= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter

    Medium 6.4

  • CVE-2025-8897unauthenticated · needs a click≤ 2.9.2.1

    Beaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site Scripting

    Medium 6.1

  • CVE-2024-43926unauthenticated · needs a click≤ 2.8.3.2

    WordPress Beaver Builder plugin <= 2.8.3.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Medium 6.1

  • CVE-2024-1038unauthenticated · needs a click≤ 2.7.4.2

    Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Reflected (DOM-Based) Cross-Site Scripting

    Medium 6.1

  • CVE-2024-53797login required≤ 2.8.4.3

    WordPress Beaver Builder plugin <= 2.8.4.3 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-37500login required≤ 2.8.2.2

    WordPress Beaver Builder plugin <= 2.8.2.2 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-30425login required≤ 2.7.4.4

    WordPress Beaver Builder plugin <= 2.7.4.4 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2023-50889login required≤ 2.7.2

    WordPress Beaver Builder Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)

    Medium 5.4

  • CVE-2024-11832contributor+≤ 2.8.4.4

    Beaver Builder – WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-9505contributor+≤ 2.8.4.2

    Beaver Builder – WordPress Page Builder <= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget

    Medium 5.4

  • CVE-2024-9049contributor+≤ 2.8.3.6

    Beaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module

    Medium 5.4

  • CVE-2024-7895contributor+≤ 2.8.3.5

    Beaver Builder (Lite Version) <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter

    Medium 5.4

  • CVE-2024-4430contributor+≤ 2.8.1.2

    Beaver Builder <= 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photo widget crop attribute

    Medium 5.4

  • CVE-2024-3923contributor+≤ 2.8.1.1

    Beaver Builder – WordPress Page Builder <= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-2925contributor+≤ 2.8.0.5

    Beaver Builder – WordPress Page Builder <= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button

    Medium 5.4

  • CVE-2024-1080contributor+≤ 2.7.4.4

    Beaver Builder – WordPress Page Builder <= 2.7.4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via heading tag

    Medium 5.4

  • CVE-2024-1074contributor+≤ 2.7.4.2

    Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Audio Widget

    Medium 5.4

  • CVE-2024-0897contributor+≤ 2.7.4.2

    Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-0896contributor+≤ 2.7.4.2

    Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-0871contributor+≤ 2.7.4.2

    Beaver Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget

    Medium 5.4

  • CVE-2024-50430high privilege≤ 2.8.3.7

    WordPress Beaver Builder plugin <= 2.8.3.7 - Cross Site Scripting (XSS) vulnerability

    Medium 4.8

  • CVE-2025-12558contributor+≤ 2.9.4

    Beaver Builder – WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure

    Medium 4.3

  • CVE-2025-12782contributor+≤ 2.9.4

    Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering

    Medium 4.3

  • CVE-2025-11726contributor+≤ 2.9.4

    Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory