Advisories · Technology
beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder.
Every CVE that names beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.1 CriticalCritical · CVSS 9+
Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Code injection
- CVSS 6.5 Medium
Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- SQL injection
- CVSS 6.5 Medium
Beaver Builder Page Builder <= 2.10.3.1 - Unauthenticated Arbitrary Shortcode Execution
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Code injection
- CVSS 6.4 Medium
Beaver Builder Page Builder <= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]'
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Cross-site scripting (XSS)
- CVSS 8.1 High
Beaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Broken access control
- CVSS 4.3 Medium
Beaver Builder – WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Information disclosure
- CVSS 4.3 Medium
Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Broken access control
- CVSS 4.3 Medium
Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Broken access control
- CVSS 6.1 Medium
Beaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site Scripting
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Beaver Builder – WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Beaver Builder – WordPress Page Builder <= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Beaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Beaver Builder (Lite Version) <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Beaver Builder <= 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photo widget crop attribute
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Beaver Builder – WordPress Page Builder <= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Beaver Builder – WordPress Page Builder <= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Reflected (DOM-Based) Cross-Site Scripting
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Beaver Builder – WordPress Page Builder <= 2.7.4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via heading tag
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Audio Widget
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Beaver Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- Cross-site scripting (XSS)