CVE-2024-2144 in Ultimate Addons for Beaver Builder Plugin
Summary
by MITRE • 03/30/2024
The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Separator widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/14/2026
The vulnerability identified as CVE-2024-2144 affects the Ultimate Addons for Beaver Builder – Lite plugin version 1.5.7 and earlier, presenting a significant security risk within WordPress environments. This plugin extension enhances the Beaver Builder page builder with additional widgets and features, making it a common component in many WordPress installations. The flaw manifests in the Image Separator widget, which is designed to add visual separators between content elements but becomes a vector for malicious code injection due to inadequate security controls.
The technical root cause of this vulnerability lies in the plugin's failure to properly sanitize user inputs and escape output data within the Image Separator widget implementation. This represents a classic stored cross-site scripting vulnerability where malicious scripts can be permanently stored on the server and executed whenever affected pages are accessed. The vulnerability specifically affects authenticated users with contributor-level permissions or higher, which is particularly concerning as it allows attackers to escalate their privileges through the injection of malicious code that executes in the context of other users' browsers.
From an operational perspective, this vulnerability creates a persistent threat vector that can be exploited by attackers who have gained contributor-level access to a WordPress site. The impact extends beyond simple script execution as it can enable attackers to steal session cookies, perform actions on behalf of users, redirect visitors to malicious sites, or even install additional malware. The stored nature of the XSS means that the malicious scripts remain active until manually removed, providing attackers with sustained access to compromised sites. This vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and can be mapped to ATT&CK technique T1566.001 related to Spearphishing Attachments and T1584.001 for Establishing Persistence through Web Shell creation.
The security implications of this vulnerability are particularly severe given the widespread adoption of both WordPress and the Ultimate Addons for Beaver Builder plugin. Attackers can leverage this vulnerability to compromise entire websites by injecting malicious scripts that persist across user sessions. The fact that contributor-level access is sufficient to exploit this vulnerability means that even relatively low-privilege accounts can be weaponized to create lasting security breaches. Organizations should consider implementing immediate mitigations including plugin updates, access control restrictions, and monitoring for unauthorized modifications to content elements.
Mitigation strategies should include immediate patching of the plugin to version 1.5.8 or later where the vulnerability has been addressed through proper input sanitization and output escaping mechanisms. Administrators should also implement strict access controls to limit contributor-level permissions to trusted users only, and consider additional security measures such as web application firewalls and regular security audits of plugin installations. The vulnerability serves as a reminder of the critical importance of input validation and output escaping in web applications, particularly when dealing with user-generated content that gets rendered on web pages. Organizations should also conduct thorough vulnerability assessments of their WordPress environments to identify similar issues in other plugins or themes that may be susceptible to similar attacks.