Plugin security history

Beaver Builder Page Builder – Drag and Drop Website Builder Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 34 vulnerability records associated with Beaver Builder Page Builder – Drag and Drop Website Builder, published between 2016 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

34Total records

0Critical

2High

32Medium

0Low

0Informational

34Patched records

0Currently marked unpatched

2016-02-08First disclosure

2026-04-07Latest disclosure

33 of 34CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2016	1	1 records
2022	5	5 records
2023	1	1 records
2024	18	18 records
2025	5	5 records
2026	4	4 records

Severity Breakdown

Severity	Records	Share
High	2	5.9%
Medium	32	94.1%

Vulnerability-Type Breakdown

Cross-Site Scripting

26 records76.5%

First: 2022. Latest: 2026.

Missing Authorization

5 records14.7%

First: 2016. Latest: 2025.

Information Disclosure

1 record2.9%

First: 2025. Latest: 2025.

Other

1 record2.9%

First: 2026. Latest: 2026.

SQL Injection

1 record2.9%

First: 2026. Latest: 2026.

Patch Status

Patched: 34
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

2.10.1.2
2.10.1.5
2.10.0.6
2.9.4.2
2.9.4.1
2.9.3.1
2.8.5.3
2.8.4.4
2.8.4.3
2.8.3.9
2.8.3.7
2.8.3.6
2.8.3.4
2.8.3
2.8.1.3
2.8.1.2
2.8.0.7
2.7.4.5
2.7.4.3
2.7.2.1
2.5.5.3
2.5.4.4
1.7.1

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-2.10.1.1`	Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]'	April 7, 2026	2.10.1.2	Medium
`*-2.10.1.2`	Beaver Builder <= 2.10.1.2 - Authenticated (Contributor+) SQL Injection	March 23, 2026	2.10.1.5	Medium
`*-2.10.0.5`	Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings	February 10, 2026	2.10.0.6	Medium
`*-2.9.4.1`	Beaver Builder <= 2.9.4.1 - Authenticated (Contributor+) Remote Code Execution	January 21, 2026	2.9.4.2	High
`*-2.9.4.1`	Beaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update	December 22, 2025	2.9.4.2	High
`*-2.9.4`	Beaver Builder – WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure	December 8, 2025	2.9.4.1	Medium
`*-2.9.4`	Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering	December 3, 2025	2.9.4.1	Medium
`*-2.9.4`	Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification	December 1, 2025	2.9.4.1	Medium
`*-2.9.2.1`	Beaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site Scripting	August 27, 2025	2.9.3.1	Medium
`*-2.8.4.4`	Beaver Builder – WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	December 12, 2024	2.8.5.3	Medium
`*-2.8.4.3`	Beaver Builder <= 2.8.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	December 2, 2024	2.8.4.4	Medium
`*-2.8.4.2`	Beaver Builder – WordPress Page Builder <= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget	October 29, 2024	2.8.4.3	Medium
`*-2.8.3.7`	Beaver Builder <= 2.8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	October 24, 2024	2.8.3.9	Medium
`*-2.8.3.6`	Beaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module	September 26, 2024	2.8.3.7	Medium
`*-2.8.3.5`	Beaver Builder (Lite Version) <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter	August 28, 2024	2.8.3.6	Medium
`*-2.8.3.2`	Beaver Builder <= 2.8.3.2 - Reflected Cross-Site Scripting	August 26, 2024	2.8.3.4	Medium
`*-2.8.2.2`	Beaver Builder <= 2.8.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	July 4, 2024	2.8.3	Medium
`*-2.8.1.2`	Beaver Builder <= 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photo widget crop attribute	May 10, 2024	2.8.1.3	Medium
`*-2.8.1.1`	Beaver Builder – WordPress Page Builder <= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 7, 2024	2.8.1.2	Medium
`*-2.8.0.5`	Beaver Builder – WordPress Page Builder <= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button	April 1, 2024	2.8.0.7	Medium
`*-2.7.4.4`	Beaver Builder <= 2.7.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	March 28, 2024	2.7.4.5	Medium
`*-2.7.4.4`	Beaver Builder – WordPress Page Builder <= 2.7.4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via heading tag	March 11, 2024	2.7.4.5	Medium
`*-2.7.4.2`	Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Audio Widget	February 28, 2024	2.7.4.3	Medium
`*-2.7.4.2`	Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Reflected (DOM-Based) Cross-Site Scripting	February 20, 2024	2.7.4.3	Medium
`*-2.7.4.2`	Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	February 20, 2024	2.7.4.3	Medium

Selected source records

Latest Records

MediumCVE-2026-2481

Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]'

Published: April 7, 2026

Affected versions: *-2.10.1.1
Patched versions: 2.10.1.2

Original Wordfence record

MediumCVE-2026-40744

Beaver Builder <= 2.10.1.2 - Authenticated (Contributor+) SQL Injection

Published: March 23, 2026

Affected versions: *-2.10.1.2
Patched versions: 2.10.1.5

Original Wordfence record

MediumCVE-2026-1231

Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings

Published: February 10, 2026

Affected versions: *-2.10.0.5
Patched versions: 2.10.0.6

Original Wordfence record

HighCVE-2025-69319

Beaver Builder <= 2.9.4.1 - Authenticated (Contributor+) Remote Code Execution

Published: January 21, 2026

Affected versions: *-2.9.4.1
Patched versions: 2.9.4.2

Original Wordfence record

HighCVE-2025-12934

Beaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update

Published: December 22, 2025

Affected versions: *-2.9.4.1
Patched versions: 2.9.4.2

Original Wordfence record

MediumCVE-2025-12558

Beaver Builder – WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure

Published: December 8, 2025

Affected versions: *-2.9.4
Patched versions: 2.9.4.1

Original Wordfence record

MediumCVE-2025-12782

Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering

Published: December 3, 2025

Affected versions: *-2.9.4
Patched versions: 2.9.4.1

Original Wordfence record

MediumCVE-2025-11726

Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification

Published: December 1, 2025

Affected versions: *-2.9.4
Patched versions: 2.9.4.1

Original Wordfence record

Highest-Severity Records

HighCVE-2025-69319

Beaver Builder <= 2.9.4.1 - Authenticated (Contributor+) Remote Code Execution

Published: January 21, 2026

Affected versions: *-2.9.4.1
Patched versions: 2.9.4.2

Original Wordfence record

HighCVE-2025-12934

Beaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update

Published: December 22, 2025

Affected versions: *-2.9.4.1
Patched versions: 2.9.4.2

Original Wordfence record

MediumCVE-2026-40744

Beaver Builder <= 2.10.1.2 - Authenticated (Contributor+) SQL Injection

Published: March 23, 2026

Affected versions: *-2.10.1.2
Patched versions: 2.10.1.5

Original Wordfence record

MediumCVE-2022-2716

Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Text Editor

Published: August 29, 2022

Affected versions: *-2.5.5.2
Patched versions: 2.5.5.3

Original Wordfence record

MediumCVE-2024-9049

Beaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module

Published: September 26, 2024

Affected versions: *-2.8.3.6
Patched versions: 2.8.3.7

Original Wordfence record

MediumCVE-2024-11832

Beaver Builder – WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: December 12, 2024

Affected versions: *-2.8.4.4
Patched versions: 2.8.5.3

Original Wordfence record

MediumCVE-2024-0897

Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: February 20, 2024

Affected versions: *-2.7.4.2
Patched versions: 2.7.4.3

Original Wordfence record

MediumCVE-2022-2517

Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Caption - On Hover

Published: August 29, 2022

Affected versions: *-2.5.5.2
Patched versions: 2.5.5.3

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory