CVE-2026-92084

Name of the Vulnerable Software and Affected Versions The Beaver Builder Page Builder – Drag and Drop Website Builder versions prior to 2.11.0.6

Description The plugin allows unauthenticated attackers to execute arbitrary shortcodes because the software fails to properly validate a value before running the do shortcode() function. This issue can be exploited if a site has a Beaver Builder page with a Sidebar module containing a widget that displays attacker-controllable text, such as the core Recent Comments widget, provided that comment moderation is disabled or the attacker's comment has been approved.

Recommendations Update to version 2.11.0.6 or later.