Arbitrary Web Script Injection Vulnerability in Beaver Builder

CVE-2024-7895

Summary

The Beaver Builder – WordPress Page Builder plugin is affected by a Stored Cross-Site Scripting (XSS) vulnerability that arises from inadequate sanitation of user inputs and failure to properly escape outputs. This vulnerability affects all versions up to 2.8.3.5 and allows authenticated users with Contributor-level privileges or higher to inject arbitrary scripts into the web pages created using the plugin. Consequently, these scripts execute whenever a visitor accesses the affected page, potentially compromising the security and integrity of the site. Proper input handling and output encoding mechanisms are essential to mitigate this type of vulnerability.

References