Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Beaver Builder Page Builder – Drag and Drop Website Builder Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 34 vulnerability records associated with Beaver Builder Page Builder – Drag and Drop Website Builder, published between 2016 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

34Total records
0Critical
2High
32Medium
0Low
0Informational
34Patched records
0Currently marked unpatched
2016-02-08First disclosure
2026-04-07Latest disclosure
33 of 34CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201611 records
202255 records
202311 records
20241818 records
202555 records
202644 records

Severity Breakdown

SeverityRecordsShare
High25.9%
Medium3294.1%

Vulnerability-Type Breakdown

Cross-Site Scripting

26 records76.5%

First: 2022. Latest: 2026.

Missing Authorization

5 records14.7%

First: 2016. Latest: 2025.

Information Disclosure

1 record2.9%

First: 2025. Latest: 2025.

Other

1 record2.9%

First: 2026. Latest: 2026.

SQL Injection

1 record2.9%

First: 2026. Latest: 2026.

Patch Status

Patched
34
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 2.10.1.2
  • 2.10.1.5
  • 2.10.0.6
  • 2.9.4.2
  • 2.9.4.1
  • 2.9.3.1
  • 2.8.5.3
  • 2.8.4.4
  • 2.8.4.3
  • 2.8.3.9
  • 2.8.3.7
  • 2.8.3.6
  • 2.8.3.4
  • 2.8.3
  • 2.8.1.3
  • 2.8.1.2
  • 2.8.0.7
  • 2.7.4.5
  • 2.7.4.3
  • 2.7.2.1
  • 2.5.5.3
  • 2.5.4.4
  • 1.7.1

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-2.7.4.2Beaver Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon WidgetFebruary 20, 20242.7.4.3Medium
*-2.7.4.2Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingFebruary 20, 20242.7.4.3Medium
*-2.7.2Beaver Builder – WordPress Page Builder <= 2.7.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingDecember 26, 20232.7.2.1Medium
*-2.5.5.2Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via 'caption'August 29, 20222.5.5.3Medium
*-2.5.5.2Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Image URLAugust 29, 20222.5.5.3Medium
*-2.5.5.2Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Caption - On HoverAugust 29, 20222.5.5.3Medium
*-2.5.5.2Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Text EditorAugust 29, 20222.5.5.3Medium
*-2.5.4.3Beaver Builder <= 2.5.4.3 - Missing AuthorizationJuly 20, 20222.5.4.4Medium
*-1.7Beaver Builder – WordPress Page Builder (Free & Pro) <= 1.7 - Authorization BypassFebruary 8, 20161.7.1Medium

Selected source records

Latest Records

MediumCVE-2026-2481

Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]'

Published: April 7, 2026

Affected versions
*-2.10.1.1
Patched versions
2.10.1.2
Original Wordfence record
MediumCVE-2026-40744

Beaver Builder <= 2.10.1.2 - Authenticated (Contributor+) SQL Injection

Published: March 23, 2026

Affected versions
*-2.10.1.2
Patched versions
2.10.1.5
Original Wordfence record
MediumCVE-2026-1231

Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings

Published: February 10, 2026

Affected versions
*-2.10.0.5
Patched versions
2.10.0.6
Original Wordfence record
HighCVE-2025-69319

Beaver Builder <= 2.9.4.1 - Authenticated (Contributor+) Remote Code Execution

Published: January 21, 2026

Affected versions
*-2.9.4.1
Patched versions
2.9.4.2
Original Wordfence record
HighCVE-2025-12934

Beaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update

Published: December 22, 2025

Affected versions
*-2.9.4.1
Patched versions
2.9.4.2
Original Wordfence record
MediumCVE-2025-12558

Beaver Builder – WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure

Published: December 8, 2025

Affected versions
*-2.9.4
Patched versions
2.9.4.1
Original Wordfence record
MediumCVE-2025-12782

Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering

Published: December 3, 2025

Affected versions
*-2.9.4
Patched versions
2.9.4.1
Original Wordfence record
MediumCVE-2025-11726

Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification

Published: December 1, 2025

Affected versions
*-2.9.4
Patched versions
2.9.4.1
Original Wordfence record

Highest-Severity Records

HighCVE-2025-69319

Beaver Builder <= 2.9.4.1 - Authenticated (Contributor+) Remote Code Execution

Published: January 21, 2026

Affected versions
*-2.9.4.1
Patched versions
2.9.4.2
Original Wordfence record
HighCVE-2025-12934

Beaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update

Published: December 22, 2025

Affected versions
*-2.9.4.1
Patched versions
2.9.4.2
Original Wordfence record
MediumCVE-2026-40744

Beaver Builder <= 2.10.1.2 - Authenticated (Contributor+) SQL Injection

Published: March 23, 2026

Affected versions
*-2.10.1.2
Patched versions
2.10.1.5
Original Wordfence record
MediumCVE-2022-2716

Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Text Editor

Published: August 29, 2022

Affected versions
*-2.5.5.2
Patched versions
2.5.5.3
Original Wordfence record
MediumCVE-2024-9049

Beaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module

Published: September 26, 2024

Affected versions
*-2.8.3.6
Patched versions
2.8.3.7
Original Wordfence record
MediumCVE-2024-11832

Beaver Builder – WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: December 12, 2024

Affected versions
*-2.8.4.4
Patched versions
2.8.5.3
Original Wordfence record
MediumCVE-2024-0897

Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: February 20, 2024

Affected versions
*-2.7.4.2
Patched versions
2.7.4.3
Original Wordfence record
MediumCVE-2022-2517

Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Caption - On Hover

Published: August 29, 2022

Affected versions
*-2.5.5.2
Patched versions
2.5.5.3
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory