SecAlerts
beaver builder logo

beaver builder

Security Risk Profile

35
/100
low

Security Risk Score

Comprehensive risk assessment based on 12 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from April 9, 2024 to present

12
Total CVEs
3
Critical+High
0
Exploited
2
Unpatched

Threat Assessment

Avg CVSS
6.2
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
2
Critical/High
Risk Level
35/100
low

Severity Distribution

Critical
0
High
3
Medium
9
Low
0

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
2

Age Distribution

Common Weaknesses (CWE)

1
XSS
8
2
Malicious File Upload
1

Most Affected Products

1. Fastlinemedia Beaver Builder Wordpress5
2. Beaver Builder WordPress Page Builder2
3. Beaver Builder Beaver Builder Plugin (Starter Version)2
4. Beaver Builder WordPress Assistant2
5. Beaver Builder PowerPack Lite2

Recent Vulnerabilities

See more →
CVE-2026-2481
CVSS 6.4medium

Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]'

4/8/2026🔧 No Patch
CVE-2025-12782
CVSS 4.3medium

Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering

12/4/2025
CVE-2025-11726
CVSS 4.3medium

Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification

12/2/2025
CVE-2025-8427
CVSS 6.4medium

Beaver Builder Plugin (Starter Version) <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'auto_play'

10/23/2025🔧 No Patch
CVE-2025-53307
CVSS 7.1high

WordPress Assistant Plugin <= 1.5.2 - Cross Site Scripting (XSS) Vulnerability

9/5/2025🔧 No Patch
CVE-2025-8897
CVSS 6.1EPSS 0%medium

Beaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site Scripting

8/28/2025
CVE-2025-4102
CVSS 7.2high

Beaver Builder Plugin (Starter Version) <= 2.9.1 - Authenticated (Administrator+) Arbitrary File Upload

6/20/2025🔧 No Patch
CVE-2025-26885
CVSS 7.2EPSS 0%high

WordPress Assistant Plugin <= 1.5.1 - PHP Object Injection vulnerability

3/3/2025
CVE-2024-12239
CVSS 6.1medium

PowerPack Lite for Beaver Builder <= 1.3.0.5 - Reflected Cross-Site Scripting via Navigate Parameter

12/17/2024🔧 No Patch
CVE-2023-6694
CVSS 6.4medium

Beaver Themer <= 1.4.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

4/9/2024🔧 No Patch

Monitor beaver builder in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.