CVE-2026-17090

Name of the Vulnerable Software and Affected Versions Beaver Builder Page Builder versions prior to 2.10.2.3

Description The Beaver Builder Page Builder plugin for WordPress contains a stored cross-site scripting issue. This occurs due to insufficient input sanitization and output escaping within the Button Module button (Button Code) setting. Authenticated attackers with author-level access or higher can inject arbitrary web scripts into pages. These scripts execute automatically when any user visits the affected page. By default, the plugin grants editor access to any WordPress role with the edit posts capability, allowing users with the Author role and above to perform this action.

Recommendations Update the plugin to a version newer than 2.10.2.2. Restrict access to the button setting in the Button Module for users with Author-level permissions until the update is applied.