WordPress Plugin Vulnerabilities

Beaver Builder < 2.5.5.3 - Authenticated Stored XSS via Caption

Description

The plugin does not sanitise and escape the caption parameter added to images via the media uploader, which could allow users with access to the plugin's editor to perform Cross-Site Scripting attacks

Affects Plugins

Plugin icon
beaver-builder-lite-version
Fixed in 2.5.5.3

References

CVE
CVE-2022-2695

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
Zhouyuan Yang
Verified
No
WPVDB ID
91fedb20-d5c4-4d5b-a1d9-f0cfd1c272a3

Timeline

Publicly Published
2022-08-30 (about 3 years ago)
Added
2022-08-30 (about 3 years ago)
Last Updated
2022-08-30 (about 3 years ago)

Other

Published
Title
Published
2024-08-16
Title
Newsletters < 4.9.9 - Reflected Cross-Site Scripting
Published
2026-01-23
Title
GZSEO < 2.0.12 - Authenticated (Contributor+) Authorization Bypass to Stored Cross-Site Scripting
Published
2019-07-27
Title
Animate It < 2.3.6 - XSS
Published
2023-12-11
Title
Popup Builder < 4.2.3 - Unauthenticated Stored XSS
Published
2022-05-02
Title
WP Subscribe < 1.2.13 - Admin+ Stored Cross-Site Scripting