CVE-2022-2517: Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Caption - On Hover
The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Caption - On Hover' value associated with images in versions up to, and including, 2.5.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with access to the Beaver Builder editor to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Beaver Builder WordPress plugin vulnerability?
The vulnerability ID for this Beaver Builder WordPress plugin vulnerability is CVE-2022-2517.
What is the severity rating of CVE-2022-2517?
The severity rating of CVE-2022-2517 is medium with a CVSS score of 5.4.
How does the Stored Cross-Site Scripting vulnerability in Beaver Builder occur?
The Stored Cross-Site Scripting vulnerability in Beaver Builder occurs due to insufficient input sanitization and output escaping in the 'Caption - On Hover' value associated with images.
Which versions of Beaver Builder are affected by this vulnerability?
Versions up to and including 2.5.5.2 of Beaver Builder are affected by this vulnerability.
Is there a fix available for CVE-2022-2517?
Yes, a fix is available for CVE-2022-2517. It is recommended to update to a version that is higher than 2.5.5.2.