beaver builder vulnerabilities and fixes

Recent CVEs affecting beaver builder, with upgrade or downgrade steps. 25 tracked.

Also searched as: beaverbuilder.

beaver builder has 25 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 25. Most recent: 2025-12-09. Highest priority: CVE-2025-4102 (score 38/100).

• CVE-2025-8897 MEDIUM 6.1 UPGRADE The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripti
• CVE-2025-11726 MEDIUM 4.3 UPGRADE The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Missing Authorization in all
• CVE-2025-12782 MEDIUM 4.3 UPGRADE The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to authorization bypass in all
• CVE-2025-8427 MEDIUM 6.4 UPGRADE The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Stored Cross-Site Scripting
• CVE-2025-12558 MEDIUM 4.3 UPGRADE The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposu
• CVE-2025-4102 HIGH 7.2 UPGRADE The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due t
• CVE-2024-9505 MEDIUM 6.4 UPGRADE The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting
• CVE-2024-9049 MEDIUM 6.4 UPGRADE The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting
• CVE-2024-7895 MEDIUM 6.4 UPGRADE The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting
• CVE-2024-53797 MEDIUM 6.5 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver B
• CVE-2024-50430 MEDIUM 5.9 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver B
• CVE-2024-4430 MEDIUM 6.4 UPGRADE The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting
• CVE-2024-43926 HIGH 7.1 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in T
• CVE-2024-3923 MEDIUM 6.4 UPGRADE The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting
• CVE-2024-37500 MEDIUM 6.5 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in T
• CVE-2024-30425 MEDIUM 6.5 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver B
• CVE-2024-2925 MEDIUM 6.4 UPGRADE The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting
• CVE-2024-1080 MEDIUM 6.4 UPGRADE The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting
• CVE-2024-1074 MEDIUM 6.4 UPGRADE The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting
• CVE-2024-1038 MEDIUM 5.4 UPGRADE The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Si
• CVE-2024-11832 MEDIUM 6.4 UPGRADE The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting
• CVE-2024-0897 MEDIUM 6.4 UPGRADE The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting
• CVE-2024-0896 MEDIUM 6.4 UPGRADE The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting
• CVE-2024-0871 MEDIUM 5.4 UPGRADE The Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Widget 'fl_b
• CVE-2023-50889 MEDIUM 6.5 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Beav

FAQ

How do I fix beaver builder vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is beaver builder being exploited right now?

None of the tracked beaver builder CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which beaver builder CVE should I patch first?

CVE-2025-4102 currently ranks highest (38/100): The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due t.

RSS feed for beaver builder · ← Back to latest CVEs