Beaver Builder Vulnerability – WordPress Page Builder – Authenticated Stored Cross-Site Scripting via Button – CVE-2024-2925 | WordPress Plugin Vulnerability Report 

Plugin Name: Beaver Builder – WordPress Page Builder

Key Information:

  • Software Type: Plugin
  • Software Slug: beaver-builder-lite-version
  • Software Status: Active
  • Software Author: justinbusa
  • Software Downloads: 9,939,163
  • Active Installs: 10,000
  • Last Updated: April 3, 2024
  • Patched Versions:
  • Affected Versions: <=

Vulnerability Details:

  • Name: Beaver Builder – WordPress Page Builder <=
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Button
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-2925
  • CVSS Score: 6.4
  • Publicly Published: April 1, 2024
  • Researcher: Wesley
  • Description: The Beaver Builder plugin is vulnerable to Stored Cross-Site Scripting (XSS) through its Button Widget. This flaw stems from insufficient sanitization and escaping of user-supplied attributes, allowing authenticated users with contributor-level or higher permissions to inject malicious scripts into web pages.


The Beaver Builder – WordPress Page Builder plugin, an integral tool for many WordPress users, contains a significant vulnerability in versions up to and including Identified as CVE-2024-2925, this vulnerability enables Stored Cross-Site Scripting attacks via the Button Widget, posing potential risks to website integrity and user security. Thankfully, this issue has been resolved in the recently released patch version

Detailed Overview:

This vulnerability was uncovered by the diligent work of security researcher Wesley, who noted the potential for malicious actors to exploit insufficient input sanitization within the plugin's Button Widget. The risk involves authenticated attackers injecting arbitrary web scripts that execute when users interact with compromised pages, leading to possible data breaches and compromised site security. The release of patch version is a critical update that addresses this vulnerability, ensuring enhanced protection for WordPress sites using Beaver Builder.

Advice for Users:

  • Immediate Action: All users of the Beaver Builder plugin should immediately update to the latest patched version,, to mitigate the vulnerability.
  • Check for Signs of Vulnerability: Site administrators should monitor their websites for any unusual activities or unauthorized content changes that might indicate exploitation.
  • Alternate Plugins: While the current vulnerability has been patched, users may still consider exploring alternative page builder plugins that offer similar functionality as a precautionary measure.
  • Stay Updated: Maintaining the latest versions of all WordPress plugins is crucial in safeguarding against potential vulnerabilities.


The prompt action by Beaver Builder's developers in addressing this vulnerability highlights the critical nature of regular software updates in maintaining website security. By ensuring that the Beaver Builder plugin is updated to version or later, users can protect their WordPress installations from potential threats associated with CVE-2024-2925.


Detailed Report: 

In the digital realm where websites serve as the cornerstone of business and communication, the security of these platforms is paramount. The recent uncovering of a vulnerability in the widely-used Beaver Builder – WordPress Page Builder plugin, identified as CVE-2024-2925, casts a spotlight on the critical need for vigilant website maintenance and the importance of timely updates. This vulnerability, allowing for Stored Cross-Site Scripting (XSS) attacks through the plugin's Button Widget, underscores the ever-present digital threats and the necessity of safeguarding your online presence.

About the Beaver Builder Plugin:

Beaver Builder, a brainchild of developer Justin Busa, is a cornerstone in WordPress site development, boasting over 10,000 active installations. Renowned for its user-friendly interface and flexibility, it has facilitated the creation and design of dynamic web pages for a myriad of users. Despite its accolades, the plugin found itself vulnerable in versions up to and including, a stark reminder that no digital tool is impervious to threats.

Vulnerability Details:

  • CVE-2024-2925: This vulnerability stems from insufficient input sanitization within the Button Widget, allowing authenticated users with contributor-level access or higher to execute harmful scripts. Such a breach poses significant risks, from data theft to unauthorized content alteration.
  • Impact: The potential ramifications of this vulnerability are extensive, potentially compromising site integrity, user data security, and overall trust in the affected websites.
  • Patched Version: The developers' prompt issuance of this update is a testament to the importance of swift action in the face of security threats.

Risks and Potential Impacts:

The risks associated with CVE-2024-2925 are not to be underestimated. Stored XSS vulnerabilities can lead to serious security breaches, including unauthorized access to sensitive information, manipulation of site content, and distribution of malware to unsuspecting users. For small business owners, such incidents can result in irreparable damage to reputation, loss of customer trust, and potential legal ramifications.

Remediation Steps:

To mitigate the risks posed by CVE-2024-2925, users of the Beaver Builder plugin must promptly update to version Regular monitoring for unusual site activities and reviewing user permissions can further bolster security. Awareness and implementation of such proactive measures are crucial in maintaining a secure online environment.

Historical Context:

This is not the first time vulnerabilities have been identified in Beaver Builder; with 13 previous vulnerabilities reported since February 8, 2016, the plugin's history underscores the persistent challenge of digital security. Each resolved vulnerability represents a lesson learned and a step forward in the ongoing battle against cyber threats.


The discovery and resolution of CVE-2024-2925 within the Beaver Builder plugin illuminate the indispensable role of ongoing vigilance and timely updates in securing digital assets. For small business owners, the task of managing a website's security might seem daunting amidst myriad responsibilities. However, the consequences of neglecting such duties can be far more onerous. Leveraging automated updates, employing reputable security solutions, and staying informed on the latest cybersecurity trends are pivotal steps in ensuring your WordPress site remains a safe and trustworthy conduit for your business endeavors. In the digital age, the adage "an ounce of prevention is worth a pound of cure" has never been more pertinent, especially when it comes to safeguarding the lifeline of your digital presence.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Beaver Builder Vulnerability – WordPress Page Builder – Authenticated Stored Cross-Site Scripting via Button – CVE-2024-2925 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment