← Back to the live CVE advisory feed

CVE-2026-92084: Beaver Builder Page Builder – Drag and Drop Website Builder

Severity

9.1 (CRITICAL)

Vendor

BEAVERBUILDER

Affected versions

0 through 2.11.0.5

Patch status

Unknown

Published

2026-10-03T08:16:26.990

Modified

2026-10-03T08:16:26.990

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.

Technical summary

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires the target site to have a Beaver Builder page containing the Sidebar module populated with a widget that displays attacker-controllable text, such as the core Recent Comments widget, with comment moderation disabled or the attacker's comment approved.

View the official NVD record for CVE-2026-92084

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.