Description

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Button Module 'button' (Button Code) Setting in all versions up to, and including, 2.10.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Beaver Builder grants editor access to any WordPress role holding the edit_posts capability by default, meaning Author-level users and above can exploit this vulnerability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-15T04:18:15.940Z",
  "pubdate": "2026-08-15T04:18:15.940Z",
  "executiveSummary": "The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to, and including, 2.10.2.2.\nThis security flaw arises due to insufficient input sanitization and output escaping implemented within the Button Module 'button' (Button Code) setting.\nAuthenticated attackers possessing author-level access and above can exploit this vector to inject arbitrary malicious web scripts into web pages.\nBecause Beaver Builder grants editor access by default to any WordPress role that possesses the edit_posts capability, attackers with author privileges can successfully execute the attack payload.\nThe injected script executes within the context of a victim's browser session whenever any user accesses the compromised page.\nThe primary risk implication is session hijacking, unauthorized administrative actions, and defacement or compromise of the WordPress site integrity via authenticated persistent script injection.",
  "technicalDetails": "The vulnerability resides in the Button Module component of the Beaver Builder Page Builder plugin, specifically within the handling of the 'button' (Button Code) setting across all versions up to, and including, 2.10.2.2.\nThe root cause of the vulnerability is the lack of proper input sanitization and output escaping mechanisms for user-supplied data submitted via the vulnerable module setting.\nExploitation of this vulnerability requires authenticated access to the WordPress environment with author-level privileges or higher.\nBeaver Builder's default permission model grants editor access to any WordPress role holding the edit_posts capability, facilitating exploitation by Author-level users.\nThe attack flow proceeds as follows: an authenticated attacker with the requisite privileges navigates to the Beaver Builder interface and edits a post or page containing the Button Module.\nThe attacker then injects arbitrary malicious web scripts, such as JavaScript payloads, directly into the 'button' (Button Code) setting.\nUpon saving the module configuration, the malicious payload is stored persistently within the database without adequate sanitization.\nWhen a victimized user or administrator accesses the publicly rendered page containing the affected Button Module, the application outputs the raw, unescaped script into the Document Object Model (DOM).\nThe browser executes the injected script within the security context of the victim's current session, allowing the attacker to perform actions on behalf of the user, steal session cookies, or propagate further malicious activity within the WordPress installation."
}