Executive brief
Beaver Builder is a popular WordPress page builder plugin used by web designers and agencies to create and manage website layouts. A vulnerability in the Starter Version allows unauthenticated attackers to inject malicious scripts into web pages through a URL parameter, which execute when a user clicks a malicious link. This could lead to session hijacking, credential theft, or defacement of pages viewed by affected users.
Technical details
The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw in the 'no_results_message' and 'node_preview' parameters, present in Beaver Builder Starter Version up to 2.11.0.1. The root cause is insufficient input sanitization and output escaping of user-supplied data in these parameters. The attack is network-based and requires no authentication; however, it requires user interaction (clicking a crafted link). An attacker can inject arbitrary JavaScript that executes in the victim's browser within the context of the affected WordPress site. Patches should be available in versions beyond 2.11.0.1.
Affected products
- Beaver Builder Beaver Builder up to and including 2.11.0.1
Timeline
- 2026-09-05: disclosed