WordPress beaver-builder-lite-version has 18 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2022-36425 | Broken Access Control vulnerability in Beaver Builder plugin <= 2.5.4.3 at WordPress. | medium | 5.4 | <=2.5.4.3 | – |
| CVE-2024-1038 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via a 'playground | medium | 5.4 | <2.7.4.3 | 2.7.4.3 |
| CVE-2024-1074 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the audio widget 'link_url | medium | 6.4 | <2.7.4.3 | 2.7.4.3 |
| CVE-2024-0896 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link parameter | medium | 6.4 | <2.7.4.3 | 2.7.4.3 |
| CVE-2024-4430 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the photo widget crop attr | medium | 6.4 | <2.8.1.3 | 2.8.1.3 |
| CVE-2024-3923 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_target parameter | medium | 6.4 | <=2.8.1.2 | – |
| CVE-2025-12558 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and | medium | 4.3 | <2.9.4.1 | 2.9.4.1 |
| CVE-2024-0897 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image URL parameter in | medium | 6.4 | <2.7.4.3 | 2.7.4.3 |
| CVE-2024-1080 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via the heading tag in | medium | 6.4 | <2.7.4.5 | 2.7.4.5 |
| CVE-2024-2925 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Widget | medium | 6.4 | <2.8.0.7 | 2.8.0.7 |
| CVE-2024-7895 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in al | medium | 6.4 | <2.8.3.6 | 2.8.3.6 |
| CVE-2024-0871 | The Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Widget 'fl_builder_data[node_preview][link | medium | 5.4 | <2.7.4.3 | 2.7.4.3 |
| CVE-2024-9505 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget | medium | 6.4 | <2.8.4.3 | 2.8.4.3 |
| CVE-2024-9049 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Group | medium | 6.4 | <2.8.3.7 | 2.8.3.7 |
| CVE-2025-11726 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including | medium | 4.3 | <2.9.4.1 | 2.9.4.1 |
| CVE-2025-12782 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, | medium | 4.3 | <2.9.4.1 | 2.9.4.1 |
| CVE-2024-11832 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JavaScript row | medium | 6.4 | <2.8.5.3 | 2.8.5.3 |
| CVE-2025-8897 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘'fl_builder' param | medium | 6.1 | <=2.9.2.1 | – |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked