Plugin icon

Beaver Builder Page Builder – Drag and Drop Website Builder

beaver-builder-lite-version

Vulnerabilities:

31

Last Updated:

April 6, 2026

Active Installs:

100000

Published
Title
Fixed in
CVSS
Published
2026-04-07
Title
Beaver Builder Page Builder – Drag and Drop Website Builder < 2.10.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]'
Fixed in
Fixed in 2.10.1.2
CVSS
5.5 (medium)
Published
2026-02-10
Title
Beaver Builder Page Builder – Drag and Drop Website Builder < 2.10.0.6 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings
Fixed in
Fixed in 2.10.0.6
CVSS
6.4 (medium)
Published
2026-01-21
Title
Beaver Builder < 2.9.4.2 - Contributor+ Remote Code Execution
Fixed in
Fixed in 2.9.4.2
CVSS
7.2 (high)
Published
2025-12-22
Title
Beaver Builder – WordPress Page Builder < 2.9.4.2 - Subscriber+ Arbitrary Beaver Builder Post Update
Fixed in
Fixed in 2.9.4.2
CVSS
6.8 (medium)
Published
2025-12-08
Title
Beaver Builder – WordPress Page Builder < 2.9.4.1 - Authenticated (Contributor+) Sensitive Information Exposure
Fixed in
Fixed in 2.9.4.1
CVSS
4.3 (medium)
Published
2025-12-03
Title
Beaver Builder – WordPress Page Builder < 2.9.4.1 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering
Fixed in
Fixed in 2.9.4.1
CVSS
4.3 (medium)
Published
2025-12-01
Title
Beaver Builder – WordPress Page Builder < 2.9.4.1 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification
Fixed in
Fixed in 2.9.4.1
CVSS
4.3 (medium)
Published
2025-08-27
Title
Beaver Builder Plugin (Lite Version) < 2.9.3.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.9.3.1
CVSS
6.1 (medium)
Published
2024-12-12
Title
Beaver Builder – WordPress Page Builder < 2.8.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.8.5.3
CVSS
6.4 (medium)
Published
2024-12-02
Title
Beaver Builder < 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.8.4.4
CVSS
6.4 (medium)
Published
2024-10-29
Title
Beaver Builder – WordPress Page Builder < 2.8.4.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget
Fixed in
Fixed in 2.8.4.3
CVSS
6.4 (medium)
Published
2024-10-24
Title
Beaver Builder < 2.8.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.8.3.9
CVSS
6.4 (medium)
Published
2024-09-26
Title
Beaver Builder – WordPress Page Builder < 2.8.3.7 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module
Fixed in
Fixed in 2.8.3.7
CVSS
6.4 (medium)
Published
2024-08-28
Title
Beaver Builder (Lite Version) < 2.8.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter
Fixed in
Fixed in 2.8.3.6
CVSS
6.4 (medium)
Published
2024-08-26
Title
Beaver Builder < 2.8.3.4 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.8.3.4
CVSS
6.1 (medium)
Published
2024-07-04
Title
Beaver Builder < 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.8.3
CVSS
6.4 (medium)
Published
2024-05-10
Title
Beaver Builder < 2.8.1.3 - Contributor+ Stored Cross-Site Scripting via photo widget crop attribute
Fixed in
Fixed in 2.8.1.3
CVSS
6.4 (medium)
Published
2024-05-07
Title
Beaver Builder – WordPress Page Builder < 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.8.1.2
CVSS
6.4 (medium)
Published
2024-04-01
Title
Beaver Builder < 2.8.0.7 - Contributor+ Stored XSS
Fixed in
Fixed in 2.8.0.7
CVSS
5.9 (medium)
Published
2024-03-11
Title
Beaver Builder < 2.7.4.5 - Contributor+ Stored Cross-Site Scripting via heading tag
Fixed in
Fixed in 2.7.4.5
CVSS
6.4 (medium)
Published
2024-02-28
Title
Beaver Builder – WordPress Page Builder < 2.7.4.3 - Contributor+ Stored XSS
Fixed in
Fixed in 2.7.4.3
CVSS
5.9 (medium)
Published
2024-02-20
Title
Beaver Builder < 2.7.4.3 - Contributor+ Stored XSS
Fixed in
Fixed in 2.7.4.3
CVSS
5.9 (medium)
Published
2024-02-20
Title
Beaver Builder < 2.7.4.3 - Contributor+ Stored XSS via Icon Widget
Fixed in
Fixed in 2.7.4.3
CVSS
5.9 (medium)
Published
2024-02-20
Title
Beaver Builder < 2.7.4.3 - Contributor+ Stored XSS
Fixed in
Fixed in 2.7.4.3
CVSS
5.9 (medium)
Published
2024-02-20
Title
Beaver Builder < 2.7.4.3 - Reflected XSS
Fixed in
Fixed in 2.7.4.3
CVSS
7.1 (high)
Published
2023-12-26
Title
Beaver Builder < 2.7.2.1 - Contributor+ Stored XSS
Fixed in
Fixed in 2.7.2.1
CVSS
5.9 (medium)
Published
2022-08-30
Title
Beaver Builder < 2.5.5.3 - Authenticated Stored XSS via Caption On Hover
Fixed in
Fixed in 2.5.5.3
CVSS
6.4 (medium)
Published
2022-08-30
Title
Beaver Builder < 2.5.5.3 - Authenticated Stored XSS via Caption
Fixed in
Fixed in 2.5.5.3
CVSS
6.4 (medium)
Published
2022-08-29
Title
Beaver Builder < 2.5.5.3 - Authenticated Stored XSS via Text Editor
Fixed in
Fixed in 2.5.5.3
CVSS
6.4 (medium)
Published
2022-08-29
Title
Beaver Builder < 2.5.5.3 - Authenticated Stored XSS via Image URL
Fixed in
Fixed in 2.5.5.3
CVSS
6.4 (medium)
Published
2022-07-20
Title
Beaver Builder < 2.5.4.4 - Subscriber+ Arbitrary Post Builder Layout Disabling
Fixed in
Fixed in 2.5.4.4
CVSS
5.4 (medium)