The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘auto_play’ parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
| Link | Resource |
|---|---|
| https://www.wordfence.com/threat-intel/vulnerabilities/id/afec9b5b-da37-4e12-935e-9d3bb3ca01f0?source=cve | Product Third Party Advisory |
| https://www.wpbeaverbuilder.com/change-logs/ | Release Notes |
Configurations
History
19 Dec 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:fastlinemedia:beaver_builder:*:*:*:*:lite:wordpress:*:* | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/afec9b5b-da37-4e12-935e-9d3bb3ca01f0?source=cve - Product, Third Party Advisory | |
| References | () https://www.wpbeaverbuilder.com/change-logs/ - Release Notes | |
| First Time |
Fastlinemedia
Fastlinemedia beaver Builder |
23 Oct 2025, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-23 13:15
Updated : 2025-12-19 22:15
NVD link : CVE-2025-8427
Mitre link : CVE-2025-8427
CVE.ORG link : CVE-2025-8427
JSON object : View
Products Affected
fastlinemedia
- beaver_builder
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')