Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Beaver Builder Page Builder – Drag and Drop Website Builder — Vulnerabilities & Security Advisories 24

All 24 CVE vulnerabilities found in Beaver Builder Page Builder – Drag and Drop Website Builder, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerabilities specific to the Beaver Builder Page Builder – Drag and Drop Website Builder, a popular drag-and-drop website creation tool. It collects a comprehensive set of security issues reported for this product, covering both historical and recent disclosures spanning several years. Readers can use this section to track the vendor's security advisories, understand the dominant weakness classes affecting the product, and review its full vulnerability history. The listings are organized to highlight patterns in exploitability and impact, helping security teams assess risk exposure without needing to consult multiple external databases. All entries are verified against public CVE records and vendor patches, ensuring accuracy and relevance for audit and compliance workflows. No specific CVE IDs are listed here; instead, the focus is on the nature of the defects—such as cross-site scripting, SQL injection, or privilege escalation—along with affected versions and patch status.

Vendor: beaverbuilder

CVE ID Title CVSS Severity Published
CVE-2026-92084 Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output CWE-94 9.1 Critical 2026-10-03
CVE-2026-95865 Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter CWE-89 6.5 Medium 2026-10-03
CVE-2026-18021 Beaver Builder Page Builder <= 2.10.3.1 - Unauthenticated Arbitrary Shortcode Execution CWE-94 6.5 Medium 2026-09-08
CVE-2026-17090 Beaver Builder Page Builder <= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter CWE-79 6.4 Medium 2026-08-15
CVE-2026-2481 Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]' CWE-79 6.4 Medium 2026-04-08
CVE-2026-1231 Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings CWE-79 6.4 Medium 2026-02-11
CVE-2025-12934 Beaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update CWE-862 8.1 High 2025-12-23
CVE-2025-12558 Beaver Builder – WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure CWE-200 4.3 Medium 2025-12-09
CVE-2025-12782 Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering CWE-862 4.3 Medium 2025-12-04
CVE-2025-11726 Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification CWE-862 4.3 Medium 2025-12-02
CVE-2025-8897 Beaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site Scripting CWE-79 6.1 Medium 2025-08-28
CVE-2024-11832 Beaver Builder – WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2024-12-13
CVE-2024-9505 Beaver Builder – WordPress Page Builder <= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget CWE-79 6.4 Medium 2024-10-29
CVE-2024-9049 Beaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module CWE-79 6.4 Medium 2024-09-27
CVE-2024-7895 Beaver Builder (Lite Version) <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter CWE-79 6.4 Medium 2024-08-29
CVE-2024-4430 Beaver Builder <= 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photo widget crop attribute CWE-79 6.4 Medium 2024-05-10
CVE-2024-3923 Beaver Builder – WordPress Page Builder <= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2024-05-09
CVE-2024-2925 Beaver Builder – WordPress Page Builder <= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button CWE-79 6.4 Medium 2024-04-02
CVE-2024-1038 Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Reflected (DOM-Based) Cross-Site Scripting CWE-79 5.4 Medium 2024-03-13
CVE-2024-1080 Beaver Builder – WordPress Page Builder <= 2.7.4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via heading tag CWE-79 6.4 Medium 2024-03-13
CVE-2024-1074 Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Audio Widget CWE-79 6.4 Medium 2024-03-13
CVE-2024-0896 Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2024-03-13
CVE-2024-0871 Beaver Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget CWE-79 5.4 Medium 2024-03-13
CVE-2024-0897 Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2024-03-13

All 24 known CVE vulnerabilities affecting Beaver Builder Page Builder – Drag and Drop Website Builder with full Chinese analysis, references, and POCs where available.