Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Beaver Builder lets strangers run custom code via sidebar

CVE-2026-92084 · published 16 days ago
Summary

Anyone can place malicious shortcodes in a Beaver Builder page that uses the Sidebar widget, causing the site to run unwanted code. This works when the sidebar shows text that an attacker can control, such as comments that are automatically approved. Update the plugin to the latest version and restrict who can add content to sidebar widgets, especially comment widgets, to stop this from happening.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
beaverbuilder beaver builder page builder – drag and drop website builder <= 2.11.0.5
Original advisory text
Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires the target site to have a Beaver Builder page containing the Sidebar module populated with a widget that displays attacker-controllable text, such as the core Recent Comments widget, with comment moderation disabled or the attacker's comment approved.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published3 Oct 2026
Updated15 Oct 2026
First seen3 Oct 2026
Sources
CVE-2026-92084 · NVD
CVE-2026-92084 · MITRE
Track software like this
Free during beta