BB
Product
Beaver Builder
31
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 1Medium 29Low 0
Watch
Add Beaver Builder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-36425 | 9.8 | Sep 6 | Broken Access Control vulnerability in Beaver Builder plugin <= 2.5.4.3 at WordPress Affected: through 2.5.4.3 |
| CVE-2025-4102 | 7.2 | Jun 20 | Beaver Builder Plugin (Starter Version) <= 2.9.1 - Authenticated (Administrator+) Arbitrary File Upload Affected: before 2.9.1.1 |
| CVE-2025-8897 | 6.1 | Aug 28 | Beaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site Scripting Affected: through 2.9.2.1 |
| CVE-2024-43926 | 6.1 | Aug 29 | WordPress Beaver Builder plugin <= 2.8.3.2 - Reflected Cross Site Scripting (XSS) vulnerability Affected: before 2.8.3.4 |
| CVE-2024-1038 | 6.1 | Mar 13 | Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Reflected (DOM-Based) Cross-Site Scripting Affected: before 2.7.4.3 |
| CVE-2025-8427 | 5.4 | Oct 23 | Beaver Builder Plugin (Starter Version) <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'auto_play' Affected: before 2.9.3.1 |
| CVE-2024-11832 | 5.4 | Dec 13 | Beaver Builder – WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: before 2.8.5.3 |
| CVE-2024-53797 | 5.4 | Dec 6 | WordPress Beaver Builder plugin <= 2.8.4.3 - Cross Site Scripting (XSS) vulnerability Affected: before 2.8.4.4 |
| CVE-2024-9505 | 5.4 | Oct 29 | Beaver Builder – WordPress Page Builder <= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget Affected: before 2.8.4.3 |
| CVE-2024-9049 | 5.4 | Sep 27 | Beaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module Affected: before 2.8.3.7 |
| CVE-2024-7895 | 5.4 | Aug 29 | Beaver Builder (Lite Version) <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter Affected: before 2.8.3.6 |
| CVE-2024-37500 | 5.4 | Jul 21 | WordPress Beaver Builder plugin <= 2.8.2.2 - Cross Site Scripting (XSS) vulnerability Affected: before 2.8.3 |
| CVE-2024-4430 | 5.4 | May 10 | Beaver Builder <= 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photo widget crop attribute Affected: before 2.8.1.3 |
| CVE-2024-3923 | 5.4 | May 9 | Beaver Builder – WordPress Page Builder <= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 2.8.1.2 |
| CVE-2024-2925 | 5.4 | Apr 2 | Beaver Builder – WordPress Page Builder <= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Affected: before 2.8.0.7 |
| CVE-2024-30425 | 5.4 | Mar 29 | WordPress Beaver Builder plugin <= 2.7.4.4 - Cross Site Scripting (XSS) vulnerability Affected: before 2.7.4.5 |
| CVE-2024-1080 | 5.4 | Mar 13 | Beaver Builder – WordPress Page Builder <= 2.7.4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via heading tag Affected: before 2.7.4.5 |
| CVE-2024-1074 | 5.4 | Mar 13 | Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Audio Widget Affected: before 2.7.4.3 |
| CVE-2024-0896 | 5.4 | Mar 13 | Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: before 2.7.4.3 |
| CVE-2024-0871 | 5.4 | Mar 13 | Beaver Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget Affected: before 2.7.4.3 |
| CVE-2024-0897 | 5.4 | Mar 13 | Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: before 2.7.4.3 |
| CVE-2023-50889 | 5.4 | Dec 29 | WordPress Beaver Builder Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS) Affected: through 2.7.2 |
| CVE-2022-2934 | 5.4 | Sep 6 | The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Image URL' value found in the Media block in versions up to, and… Affected: through 2.5.5.2 |
| CVE-2022-2716 | 5.4 | Sep 6 | The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Editor' block in versions up to, and including, 2.5.5.2 due to… Affected: through 2.5.5.2 |
| CVE-2022-2695 | 5.4 | Sep 6 | The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter added to images via the media uploader in… Affected: through 2.5.5.2 |
| CVE-2022-2517 | 5.4 | Sep 6 | The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Caption - On Hover' value associated with images in versions up to,… Affected: through 2.5.5.2 |
| CVE-2021-42748 | 5.3 | Jan 10 | In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API Affected: before 2.5.1; before 2.5.1 |
| CVE-2024-50430 | 4.8 | Nov 19 | WordPress Beaver Builder plugin <= 2.8.3.7 - Cross Site Scripting (XSS) vulnerability Affected: before 2.8.3.9 |
| CVE-2025-12558 | 4.3 | Dec 9 | Beaver Builder – WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure Affected: before 2.9.4.1 |
| CVE-2025-12782 | 4.3 | Dec 4 | Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering Affected: before 2.9.4.1 |
| CVE-2025-11726 | 4.3 | Dec 2 | Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification Affected: before 2.9.4.1 |
Showing 31