Beaver Builder Page Builder – Drag and Drop Website Builder

Software Type	Plugin
Software Slug	beaver-builder-lite-version (view on wordpress.org)
Software Status	Active
Software Author	beaverbuilder
Software Website	www.wpbeaverbuilder.com
Software Downloads	13,247,335
Software Active Installs	100,000
Software Record Last Updated	July 22, 2026

Showing 1-20 of 34 Vulnerabilities

Submit a Vulnerability

Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]'

6.4

CVE-2026-2481

Apr 7, 2026

Researchers: Athiwat Tiprasaharn (Jitlada), Tharadol Suksamran (d3kc4rt_1)

Beaver Builder <= 2.10.1.2 - Authenticated (Contributor+) SQL Injection

6.5

CVE-2026-40744

Mar 23, 2026

Researcher: daroo

Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings

6.4

CVE-2026-1231

Feb 10, 2026

Researchers: Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777), Waris Damkham

Beaver Builder <= 2.9.4.1 - Authenticated (Contributor+) Remote Code Execution

8.8

CVE-2025-69319

Jan 21, 2026

Researcher: Drew Webber (mcdruid)

Beaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update

8.1

CVE-2025-12934

Dec 22, 2025

Researcher: Athiwat Tiprasaharn (Jitlada)

Beaver Builder – WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure

4.3

CVE-2025-12558

Dec 8, 2025

Researcher: Athiwat Tiprasaharn (Jitlada)

Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering

4.3

CVE-2025-12782

Dec 3, 2025

Researchers: Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777), Powpy, Waris Damkham

Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification

4.3

CVE-2025-11726

Dec 1, 2025

Researcher: Athiwat Tiprasaharn (Jitlada)

Beaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site Scripting

6.1

CVE-2025-8897

Aug 27, 2025

Researcher: Jack Pas (Dark.)

Beaver Builder – WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-11832

Dec 12, 2024

Researcher: zer0gh0st

Beaver Builder <= 2.8.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-53797

Dec 2, 2024

Researcher: João Pedro Soares de Alcântara

Beaver Builder – WordPress Page Builder <= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget

6.4

CVE-2024-9505

Oct 29, 2024

Researcher: zer0gh0st

Beaver Builder <= 2.8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-50430

Oct 24, 2024

Researcher: João Pedro Soares de Alcântara

Beaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module

6.4

CVE-2024-9049

Sep 26, 2024

Researcher: zer0gh0st

Beaver Builder (Lite Version) <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter

6.4

CVE-2024-7895

Aug 28, 2024

Researcher: zer0gh0st

Beaver Builder <= 2.8.3.2 - Reflected Cross-Site Scripting

6.1

CVE-2024-43926

Aug 26, 2024

Researcher: Rafie Muhammad

Beaver Builder <= 2.8.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-37500

Jul 4, 2024

Researcher: João Pedro Soares de Alcântara

Beaver Builder <= 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photo widget crop attribute

6.4

CVE-2024-4430

May 10, 2024

Researcher: Thanh Nam Tran

Beaver Builder – WordPress Page Builder <= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-3923

May 7, 2024

Researcher: wesley (wcraft)

Beaver Builder – WordPress Page Builder <= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button

6.4

CVE-2024-2925

Apr 1, 2024

Researcher: wesley (wcraft)

Title	Status	CVE ID	CVSS	Researchers	Date
Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]'	Patched	CVE-2026-2481	6.4	Athiwat Tiprasaharn (Jitlada), Tharadol Suksamran (d3kc4rt_1)	April 7, 2026
Beaver Builder <= 2.10.1.2 - Authenticated (Contributor+) SQL Injection	Patched	CVE-2026-40744	6.5	daroo	March 23, 2026
Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings	Patched	CVE-2026-1231	6.4	Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777), Waris Damkham	February 10, 2026
Beaver Builder <= 2.9.4.1 - Authenticated (Contributor+) Remote Code Execution	Patched	CVE-2025-69319	8.8	Drew Webber (mcdruid)	January 21, 2026
Beaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update	Patched	CVE-2025-12934	8.1	Athiwat Tiprasaharn (Jitlada)	December 22, 2025
Beaver Builder – WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure	Patched	CVE-2025-12558	4.3	Athiwat Tiprasaharn (Jitlada)	December 8, 2025
Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering	Patched	CVE-2025-12782	4.3	Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777), Powpy, Waris Damkham	December 3, 2025
Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification	Patched	CVE-2025-11726	4.3	Athiwat Tiprasaharn (Jitlada)	December 1, 2025
Beaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site Scripting	Patched	CVE-2025-8897	6.1	Jack Pas (Dark.)	August 27, 2025
Beaver Builder – WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2024-11832	6.4	zer0gh0st	December 12, 2024
Beaver Builder <= 2.8.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2024-53797	6.4	João Pedro Soares de Alcântara	December 2, 2024
Beaver Builder – WordPress Page Builder <= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget	Patched	CVE-2024-9505	6.4	zer0gh0st	October 29, 2024
Beaver Builder <= 2.8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2024-50430	6.4	João Pedro Soares de Alcântara	October 24, 2024
Beaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module	Patched	CVE-2024-9049	6.4	zer0gh0st	September 26, 2024
Beaver Builder (Lite Version) <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter	Patched	CVE-2024-7895	6.4	zer0gh0st	August 28, 2024
Beaver Builder <= 2.8.3.2 - Reflected Cross-Site Scripting	Patched	CVE-2024-43926	6.1	Rafie Muhammad	August 26, 2024
Beaver Builder <= 2.8.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2024-37500	6.4	João Pedro Soares de Alcântara	July 4, 2024
Beaver Builder <= 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photo widget crop attribute	Patched	CVE-2024-4430	6.4	Thanh Nam Tran	May 10, 2024
Beaver Builder – WordPress Page Builder <= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2024-3923	6.4	wesley (wcraft)	May 7, 2024
Beaver Builder – WordPress Page Builder <= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button	Patched	CVE-2024-2925	6.4	wesley (wcraft)	April 1, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation