Stored Cross-Site Scripting in Beaver Builder Plugin for WordPress

CVE-2025-8427

What is CVE-2025-8427?

The Beaver Builder Plugin (Starter Version) for WordPress is affected by a vulnerability that allows stored cross-site scripting through the 'auto_play' parameter. This flaw arises from inadequate input sanitization and output escaping, enabling authenticated attackers with Contributor-level access or greater to inject malicious scripts. These scripts can execute whenever a user visits compromised pages, posing a significant threat to website security and user experience.

References