https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-12558.htmlhttps://patchthecve.com/cve/CVE-2025-12558.htmlWed, 07 Oct 2026 20:10:01 +0000MEDIUM 4.3: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via the 'get_attachment_sizes' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extrachttps://patchthecve.com/cve/CVE-2025-12782.htmlhttps://patchthecve.com/cve/CVE-2025-12782.htmlSun, 18 Oct 2026 17:10:00 +0000MEDIUM 4.3: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.4. This is due to the plugin not properly verifying a user's authorization in the disable() function. This makes it possible for authenticated attackers, whttps://patchthecve.com/cve/CVE-2025-11726.htmlhttps://patchthecve.com/cve/CVE-2025-11726.htmlSun, 18 Oct 2026 18:10:00 +0000MEDIUM 4.3: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.9.4. This is due to insufficient capability checks in the REST API endpoints under the 'fl-controls/v1' namespace that control site-wide Global Presets. Thihttps://patchthecve.com/cve/CVE-2025-8427.htmlhttps://patchthecve.com/cve/CVE-2025-8427.htmlThu, 08 Oct 2026 11:10:00 +0000MEDIUM 6.4: The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘auto_play’ parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wihttps://patchthecve.com/cve/CVE-2025-8897.htmlhttps://patchthecve.com/cve/CVE-2025-8897.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.1: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘'fl_builder' parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackhttps://patchthecve.com/cve/CVE-2025-4102.htmlhttps://patchthecve.com/cve/CVE-2025-4102.htmlWed, 17 Jun 2026 09:32:30 +0000HIGH 7.2: The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_enabled_icons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level https://patchthecve.com/cve/CVE-2024-11832.htmlhttps://patchthecve.com/cve/CVE-2024-11832.htmlWed, 17 Jun 2026 06:58:32 +0000MEDIUM 6.4: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JavaScript row settings in all versions up to, and including, 2.8.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attahttps://patchthecve.com/cve/CVE-2024-53797.htmlhttps://patchthecve.com/cve/CVE-2024-53797.htmlWed, 17 Jun 2026 08:09:17 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Stored XSS.This issue affects Beaver Builder: from n/a through <= 2.8.4.3.https://patchthecve.com/cve/CVE-2024-50430.htmlhttps://patchthecve.com/cve/CVE-2024-50430.htmlWed, 17 Jun 2026 08:04:27 +0000MEDIUM 5.9: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Stored XSS.This issue affects Beaver Builder: from n/a through <= 2.8.3.7.https://patchthecve.com/cve/CVE-2024-9505.htmlhttps://patchthecve.com/cve/CVE-2024-9505.htmlWed, 17 Jun 2026 08:24:42 +0000MEDIUM 6.4: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 2.8.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fohttps://patchthecve.com/cve/CVE-2024-9049.htmlhttps://patchthecve.com/cve/CVE-2024-9049.htmlWed, 17 Jun 2026 08:23:51 +0000MEDIUM 6.4: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Group module in all versions up to, and including, 2.8.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possihttps://patchthecve.com/cve/CVE-2024-7620.htmlhttps://patchthecve.com/cve/CVE-2024-7620.htmlWed, 17 Jun 2026 08:20:33 +0000MEDIUM 6.6: The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to uploahttps://patchthecve.com/cve/CVE-2024-43926.htmlhttps://patchthecve.com/cve/CVE-2024-43926.htmlWed, 17 Jun 2026 07:52:00 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Beaver Builder Team Beaver Builder allows Reflected XSS.This issue affects Beaver Builder: from n/a through 2.8.3.2.https://patchthecve.com/cve/CVE-2024-7895.htmlhttps://patchthecve.com/cve/CVE-2024-7895.htmlWed, 17 Jun 2026 08:21:08 +0000MEDIUM 6.4: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.8.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Cohttps://patchthecve.com/cve/CVE-2024-37500.htmlhttps://patchthecve.com/cve/CVE-2024-37500.htmlWed, 17 Jun 2026 07:38:28 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Beaver Builder Team Beaver Builder allows Stored XSS.This issue affects Beaver Builder: from n/a through 2.8.2.2.https://patchthecve.com/cve/CVE-2024-4430.htmlhttps://patchthecve.com/cve/CVE-2024-4430.htmlWed, 17 Jun 2026 08:01:51 +0000MEDIUM 6.4: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the photo widget crop attribute in all versions up to, and including, 2.8.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackehttps://patchthecve.com/cve/CVE-2024-3923.htmlhttps://patchthecve.com/cve/CVE-2024-3923.htmlWed, 17 Jun 2026 07:45:28 +0000MEDIUM 6.4: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_target parameter in all versions up to, and including, 2.8.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wihttps://patchthecve.com/cve/CVE-2023-6695.htmlhttps://patchthecve.com/cve/CVE-2023-6695.htmlWed, 17 Jun 2026 06:51:15 +0000MEDIUM 6.5: The Beaver Themer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.9 via the 'wpbb' shortcode. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including arbitrary user_meta https://patchthecve.com/cve/CVE-2023-6694.htmlhttps://patchthecve.com/cve/CVE-2023-6694.htmlWed, 17 Jun 2026 06:51:15 +0000MEDIUM 6.4: The Beaver Themer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping on user supplied custom fields. This makes it possible for authenticated attackers https://patchthecve.com/cve/CVE-2024-2925.htmlhttps://patchthecve.com/cve/CVE-2024-2925.htmlWed, 17 Jun 2026 07:25:50 +0000MEDIUM 6.4: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Widget in all versions up to, and including, 2.8.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fohttps://patchthecve.com/cve/CVE-2024-30425.htmlhttps://patchthecve.com/cve/CVE-2024-30425.htmlWed, 17 Jun 2026 07:26:56 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows DOM-Based XSS.This issue affects Beaver Builder: from n/a through <= 2.7.4.4.https://patchthecve.com/cve/CVE-2024-1080.htmlhttps://patchthecve.com/cve/CVE-2024-1080.htmlWed, 17 Jun 2026 07:03:23 +0000MEDIUM 6.4: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via the heading tag in all versions up to, and including, 2.7.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, withhttps://patchthecve.com/cve/CVE-2024-1074.htmlhttps://patchthecve.com/cve/CVE-2024-1074.htmlWed, 17 Jun 2026 07:03:23 +0000MEDIUM 6.4: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the audio widget 'link_url' parameter in all versions up to, and including, 2.7.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated ahttps://patchthecve.com/cve/CVE-2024-1038.htmlhttps://patchthecve.com/cve/CVE-2024-1038.htmlWed, 17 Jun 2026 07:03:18 +0000MEDIUM 5.4: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via a 'playground.wordpress.net' parameter in all versions up to, and including, 2.7.4.2 due to insufficient input sanitization and output escaping. This makes it possible for uhttps://patchthecve.com/cve/CVE-2024-0897.htmlhttps://patchthecve.com/cve/CVE-2024-0897.htmlWed, 17 Jun 2026 06:54:31 +0000MEDIUM 6.4: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image URL parameter in all versions up to, and including, 2.7.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, withhttps://patchthecve.com/cve/CVE-2024-0896.htmlhttps://patchthecve.com/cve/CVE-2024-0896.htmlWed, 17 Jun 2026 06:54:31 +0000MEDIUM 6.4: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link parameter in all versions up to, and including, 2.7.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers withttps://patchthecve.com/cve/CVE-2024-0871.htmlhttps://patchthecve.com/cve/CVE-2024-0871.htmlWed, 17 Jun 2026 06:54:28 +0000MEDIUM 5.4: The Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Widget 'fl_builder_data[node_preview][link]' and 'fl_builder_data[settings][link_target]' parameters in all versions up to, and including, 2.7.4.2 due to insufficient input sanitization and output escaphttps://patchthecve.com/cve/CVE-2023-50889.htmlhttps://patchthecve.com/cve/CVE-2023-50889.htmlWed, 17 Jun 2026 06:40:10 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Beaver Builder Team Beaver Builder – WordPress Page Builder allows Stored XSS.This issue affects Beaver Builder – WordPress Page Builder: from n/a through 2.7.2.