Log in Start free

beaverbuilder

Products

ProductCVEsExploitedLatest
Beaver Builder Page Builder – Drag and Drop Website Builder24–Oct 3, 2026
Customizer Export/Import1–Sep 7, 2024

Exploited and recent CVEs

  • CVE-2026-92084 Critical 9.1 Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output 0.8%
  • CVE-2026-95865 Medium 6.5 Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter 0.3%
  • CVE-2026-18021 Medium 6.5 Beaver Builder Page Builder <= 2.10.3.1 - Unauthenticated Arbitrary Shortcode Execution 0.5%
  • CVE-2026-17090 Medium 6.4 Beaver Builder Page Builder <= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter 0.4%
  • CVE-2026-2481 Medium 6.4 Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]' 0.3%
  • CVE-2026-1231 Medium 6.4 Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings 0.2%
  • CVE-2025-12934 High 8.1 Beaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update 0.4%
  • CVE-2025-12558 Medium 4.3 Beaver Builder – WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure 0.4%
  • CVE-2025-12782 Medium 4.3 Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering 0.3%
  • CVE-2025-11726 Medium 4.3 Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification 0.3%
  • CVE-2025-8897 Medium 6.1 Beaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site Scripting 0.2%
  • CVE-2024-11832 Medium 6.4 Beaver Builder – WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.2%
  • CVE-2024-9505 Medium 6.4 Beaver Builder – WordPress Page Builder <= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget 0.3%
  • CVE-2024-9049 Medium 6.4 Beaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module 0.3%
  • CVE-2024-7620 Medium 6.6 Customizer Export/Import <= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import 0.7%
  • CVE-2024-7895 Medium 6.4 Beaver Builder (Lite Version) <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter 0.4%
  • CVE-2024-4430 Medium 6.4 Beaver Builder <= 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photo widget crop attribute 0.5%
  • CVE-2024-3923 Medium 6.4 Beaver Builder – WordPress Page Builder <= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.4%
  • CVE-2024-2925 Medium 6.4 Beaver Builder – WordPress Page Builder <= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button 0.4%
  • CVE-2024-1038 Medium 5.4 Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Reflected (DOM-Based) Cross-Site Scripting 0.6%
  • CVE-2024-1080 Medium 6.4 Beaver Builder – WordPress Page Builder <= 2.7.4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via heading tag 0.4%
  • CVE-2024-1074 Medium 6.4 Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Audio Widget 0.5%
  • CVE-2024-0896 Medium 6.4 Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.5%
  • CVE-2024-0871 Medium 5.4 Beaver Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget 0.4%
  • CVE-2024-0897 Medium 6.4 Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.4%