The Beaver Builder Team
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Beaver Builder Plugin (Starter Version) | 3 | – | Sep 5, 2026 |
| Beaver Builder | 2 | – | Aug 29, 2024 |
| Beaver Builder – WordPress Page Builder | 1 | – | Dec 29, 2023 |
| Beaver Builder – WordPress Page Builder (WordPress plugin) | 1 | – | Sep 6, 2022 |
Exploited and recent CVEs
- CVE-2026-18843 Beaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter 0.3%
- CVE-2025-8427 Beaver Builder Plugin (Starter Version) <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'auto_play' 0.2%
- CVE-2025-4102 Beaver Builder Plugin (Starter Version) <= 2.9.1 - Authenticated (Administrator+) Arbitrary File Upload 0.6%
- CVE-2024-43926 WordPress Beaver Builder plugin <= 2.8.3.2 - Reflected Cross Site Scripting (XSS) vulnerability 0.3%
- CVE-2024-37500 WordPress Beaver Builder plugin <= 2.8.2.2 - Cross Site Scripting (XSS) vulnerability 0.3%
- CVE-2023-50889 WordPress Beaver Builder Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS) 0.3%
- CVE-2022-36425 WordPress Beaver Builder plugin <= 2.5.4.3 - Broken Access Control vulnerability 0.9%