CVE-2026-17090 in Page Builder Plugin
Summary
by MITRE • 08/15/2026
The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Button Module 'button' (Button Code) Setting in all versions up to, and including, 2.10.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Beaver Builder grants editor access to any WordPress role holding the edit_posts capability by default, meaning Author-level users and above can exploit this vulnerability.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in Beaver Builder Page Builder represents a critical stored cross-site scripting flaw that affects all versions up to and including 2.10.2.2. This security weakness resides within the Button Module's 'button' setting, specifically in how the plugin handles the Button Code parameter. The issue stems from inadequate input sanitization and insufficient output escaping mechanisms that fail to properly validate or encode user-supplied data before storing it in the database. Attackers with author-level privileges or higher can exploit this vulnerability by injecting malicious JavaScript code through the button module configuration, which then gets stored and executed whenever any user accesses pages containing the compromised content.
The operational impact of this vulnerability extends beyond simple script execution as it provides attackers with persistent access to victim systems through a sophisticated attack vector. Since Beaver Builder grants editor capabilities to users with the edit_posts capability by default, this means that authors, editors, and administrators can all potentially exploit this weakness. The stored nature of the XSS vulnerability allows attackers to create malicious payloads that persist in the database and execute automatically when other users view affected pages, making it particularly dangerous for content management systems where multiple users contribute to website content. This vulnerability directly maps to CWE-79, which describes cross-site scripting flaws resulting from insufficient input validation and output escaping.
The attack surface for this vulnerability is significant given WordPress's widespread adoption and the typical privilege structure of content management systems. Authors typically have sufficient permissions to modify page elements including button modules, making this an attractive target for attackers seeking persistent access to websites. The exploitation process involves crafting malicious JavaScript payloads that leverage the button code field, which then executes in the context of other users' browsers when they access pages containing the compromised content. This vulnerability demonstrates how seemingly innocuous UI components can become attack vectors when proper security controls are missing from the input validation and output encoding processes.
Security mitigations for this vulnerability should focus on implementing comprehensive input sanitization and output escaping mechanisms throughout the plugin's codebase. The recommended approach includes validating all user inputs against strict whitelists, applying appropriate HTML encoding to output data, and implementing Content Security Policy headers to limit script execution. Additionally, developers should implement proper privilege checks and ensure that only authorized users can modify critical UI components. This vulnerability aligns with ATT&CK technique T1566.001 which describes social engineering through the use of malicious links or content injection methods. Organizations should immediately update to patched versions of Beaver Builder, conduct thorough security audits of their WordPress installations, and implement monitoring for suspicious user activities that might indicate exploitation attempts.