Description

The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter in all versions up to, and including, 2.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-05T07:17:11.207Z",
  "pubdate": "2026-09-05T07:17:11.207Z",
  "executiveSummary": "The Beaver Builder Plugin (Starter Version) for WordPress is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability residing within the 'no_results_message' node_preview parameter. This security flaw exists in all versions up to and including 2.11.0.1.\nThe vulnerability arises due to inadequate input sanitization and output escaping mechanisms, allowing an unauthenticated attacker to inject malicious JavaScript into the web application's response. When a victim is coerced into interacting with a crafted URL, the injected script executes within the context of the user's browser session.\nSuccessful exploitation allows for the execution of arbitrary scripts, which can lead to session hijacking, sensitive data theft, unauthorized actions on behalf of the user, or redirection to malicious domains. Given the nature of reflected XSS, the impact is confined to the victim's interaction with the malicious link. The vulnerability is considered high risk because it requires no authentication to trigger, relying primarily on social engineering to entice a victim to visit the prepared payload URL. Administrators should prioritize updates to a version where this input handling is properly remediated to neutralize the injection vector.",
  "technicalDetails": "The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw located in the Beaver Builder Plugin (Starter Version) for WordPress. It specifically affects the handling of the 'no_results_message' node_preview parameter within the plugin's functionality.\nThe root cause is a failure to properly sanitize user-supplied input before passing it to the browser or failing to perform context-aware output escaping when rendering the data back to the user. Consequently, the application interprets user-controlled data as trusted HTML or JavaScript.\nExploitation follows a predictable flow. An unauthenticated attacker crafts a malicious URL containing a JavaScript payload within the 'no_results_message' parameter. This attacker then employs social engineering tactics to induce an authenticated user (such as an administrator or editor) to click the crafted link. When the victim navigates to this URL, the vulnerable component processes the malicious parameter, failing to neutralize the script tags or event handlers contained within the input. The browser receives the server response containing the attacker's script and executes it in the context of the user's active WordPress session.\nBecause the payload executes within the victim's browser session, it has full access to the Document Object Model (DOM), browser cookies, and local storage. An attacker can use this capability to steal session tokens, manipulate the page content, capture form data, or perform unauthorized administrative actions by triggering background requests (e.g., creating a new administrative user or modifying configuration settings) while the victim is authenticated.\nThe vulnerability affects all versions of the Beaver Builder Plugin (Starter Version) up to and including version 2.11.0.1. It is accessible over the network without requiring any prior authentication, making it a highly exploitable vector if the target is successfully deceived into visiting the link. The scope of impact is limited by the victim's privileges; if an administrator clicks the link, the potential for total site compromise is significant, as the script can perform any action the administrator is authorized to execute. Post-exploitation, the malicious script may also be used to establish persistence or exfiltrate sensitive information stored in the WordPress environment."
}