# cve.now: Beaverbuilder

The newest entries naming Beaverbuilder as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-92084](https://cve.now/CVE-2026-92084.md): Beaver Builder Page Builder \<= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output (CVSS 9.1)
- [CVE-2026-95865](https://cve.now/CVE-2026-95865.md): Beaver Builder Page Builder \<= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields\[\]\[value\]' Parameter (CVSS 6.5)
- [CVE-2026-18021](https://cve.now/CVE-2026-18021.md): Beaver Builder Page Builder \<= 2.10.3.1 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5)
- [CVE-2026-17090](https://cve.now/CVE-2026-17090.md): Beaver Builder Page Builder \<= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter (CVSS 6.4)
- [CVE-2026-2481](https://cve.now/CVE-2026-2481.md): Beaver Builder Page Builder – Drag and Drop Website Builder \<= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings\[js\]' (CVSS 6.4)
- [CVE-2026-1231](https://cve.now/CVE-2026-1231.md): Beaver Builder Page Builder – Drag and Drop Website Builder \<= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings (CVSS 6.4)
- [CVE-2025-12934](https://cve.now/CVE-2025-12934.md): Beaver Builder – WordPress Page Builder \<= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update (CVSS 8.1)
- [CVE-2025-12558](https://cve.now/CVE-2025-12558.md): Beaver Builder – WordPress Page Builder \<= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure (CVSS 4.3)
- [CVE-2025-12782](https://cve.now/CVE-2025-12782.md): Beaver Builder – WordPress Page Builder \<= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering (CVSS 4.3)
- [CVE-2025-11726](https://cve.now/CVE-2025-11726.md): Beaver Builder – WordPress Page Builder \<= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification (CVSS 4.3)
- [CVE-2025-8897](https://cve.now/CVE-2025-8897.md): Beaver Builder Plugin (Lite Version) \<= 2.9.2.1 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-11832](https://cve.now/CVE-2024-11832.md): Beaver Builder – WordPress Page Builder \<= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-9505](https://cve.now/CVE-2024-9505.md): Beaver Builder – WordPress Page Builder \<= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget (CVSS 6.4)
- [CVE-2024-9049](https://cve.now/CVE-2024-9049.md): Beaver Builder – WordPress Page Builder \<= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module (CVSS 6.4)
- [CVE-2024-7620](https://cve.now/CVE-2024-7620.md): Customizer Export/Import \<= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import (CVSS 6.6)
- [CVE-2024-7895](https://cve.now/CVE-2024-7895.md): Beaver Builder (Lite Version) \<= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter (CVSS 6.4)
- [CVE-2024-4430](https://cve.now/CVE-2024-4430.md): Beaver Builder \<= 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photo widget crop attribute (CVSS 6.4)
- [CVE-2024-3923](https://cve.now/CVE-2024-3923.md): Beaver Builder – WordPress Page Builder \<= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-2925](https://cve.now/CVE-2024-2925.md): Beaver Builder – WordPress Page Builder \<= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button (CVSS 6.4)
- [CVE-2024-1038](https://cve.now/CVE-2024-1038.md): Beaver Builder – WordPress Page Builder \<= 2.7.4.2 - Reflected (DOM-Based) Cross-Site Scripting (CVSS 5.4)
- [CVE-2024-1080](https://cve.now/CVE-2024-1080.md): Beaver Builder – WordPress Page Builder \<= 2.7.4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via heading tag (CVSS 6.4)
- [CVE-2024-1074](https://cve.now/CVE-2024-1074.md): Beaver Builder – WordPress Page Builder \<= 2.7.4.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Audio Widget (CVSS 6.4)
- [CVE-2024-0896](https://cve.now/CVE-2024-0896.md): Beaver Builder – WordPress Page Builder \<= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-0871](https://cve.now/CVE-2024-0871.md): Beaver Builder \<= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget (CVSS 5.4)
- [CVE-2024-0897](https://cve.now/CVE-2024-0897.md): Beaver Builder – WordPress Page Builder \<= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/beaverbuilder
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.