CVE-2024-2925 in Beaver Builder Plugin
Summary
by MITRE • 04/02/2024
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Widget in all versions up to, and including, 2.8.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/14/2026
The vulnerability identified as CVE-2024-2925 affects the Beaver Builder WordPress plugin, specifically targeting the Button Widget functionality within versions up to and including 2.8.0.5. This represents a critical security flaw that enables authenticated attackers with contributor-level privileges or higher to execute stored cross-site scripting attacks. The vulnerability stems from inadequate input sanitization and output escaping mechanisms that fail to properly validate or escape user-supplied attributes before they are stored and subsequently rendered in web pages. The affected plugin serves as a popular page builder tool for WordPress websites, making this vulnerability particularly concerning given the widespread adoption of the software across various web platforms.
The technical nature of this vulnerability places it squarely within CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') which is a fundamental web application security weakness. The flaw occurs when user-provided data enters the application through a trusted source and is stored in a database or file system, later retrieved and displayed without proper sanitization. In this case, the Button Widget's attribute handling fails to implement proper input validation or output encoding, creating an environment where malicious scripts can be persisted and executed against unsuspecting users. The vulnerability specifically impacts the plugin's ability to properly escape HTML output when rendering user-defined button attributes, allowing attackers to inject malicious JavaScript code that executes in the context of other users' browsers.
The operational impact of this vulnerability is significant as it allows attackers to escalate privileges and potentially compromise entire WordPress installations. Since contributors and above have sufficient permissions to modify content, an attacker can craft malicious button widgets containing script payloads that will execute whenever any user accesses pages containing the compromised content. This creates a persistent threat vector where the malicious code can affect any user who views affected pages, potentially leading to session hijacking, data theft, or further exploitation of the compromised WordPress environment. The vulnerability also aligns with ATT&CK technique T1566.001 - Phishing: Spearphishing Attachment, as attackers could leverage this flaw to deliver malicious payloads through seemingly legitimate page content, making detection more difficult.
Mitigation strategies for CVE-2024-2925 should prioritize immediate plugin updates to versions that address the input sanitization and output escaping deficiencies. Administrators should implement strict content validation policies and consider limiting contributor-level permissions to reduce the attack surface. Network monitoring solutions should be configured to detect suspicious script injection patterns, while regular security audits of WordPress plugins can help identify similar vulnerabilities. The vulnerability also highlights the importance of proper input validation frameworks and output encoding practices in web application development, emphasizing the need for comprehensive security testing including both static and dynamic analysis of user input handling mechanisms. Organizations should also implement content security policies to provide additional defense-in-depth against script execution vulnerabilities.