CVE-2025-8897

Name of the Vulnerable Software and Affected Versions: Beaver Builder – WordPress Page Builder plugin versions prior to 2.9.2.1

Description: The Beaver Builder – WordPress Page Builder plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if a user is tricked into performing an action, such as clicking a link. The vulnerability occurs via the fl builder parameter.

Recommendations: Update Beaver Builder – WordPress Page Builder plugin to a version later than 2.9.2.1.