WordPress Plugin Vulnerabilities

Beaver Builder < 2.5.5.3 - Authenticated Stored XSS via Text Editor

Description

The plugin does not sanitise and escape the Text Editor block, which could allow users with access to the plugin's editor to perform Cross-Site Scripting attacks

Affects Plugins

Plugin icon
beaver-builder-lite-version
Fixed in 2.5.5.3

References

CVE
CVE-2022-2716

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
Zhouyuan Yang
Verified
No
WPVDB ID
16b21256-c76f-49c2-aac0-dee96dc163c1

Timeline

Publicly Published
2022-08-29 (about 1 years ago)
Added
2022-08-30 (about 1 years ago)
Last Updated
2022-08-30 (about 1 years ago)

Other

Published
Title
Published
2024-03-25
Title
Astra < 4.6.5 - Editor+ Stored XSS via Theme Header/Footer
Published
2024-02-07
Title
WP Shortcodes Plugin — Shortcodes Ultimate < 7.0.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
Published
2020-10-30
Title
SW Ajax WooCommerce Search < 1.2.8 - Unauthenticated Reflected XSS & XFS
Published
2024-04-04
Title
Custom post types, Custom Fields & more < 5.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-04-19
Title
WP Original Media Path < 2.4.1 - Admin+ Stored XSS