PT-2020-6783 · WordPress · Beaver Builder

Zhouyuan Yang · Published 2020-06-05 · Updated 2022-09-13 · CVE-2022-2716

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Beaver Builder versions up to, and including, 2.5.5.2

Description The issue exists due to insufficient input sanitization and output escaping in the 'Text Editor' block of the Beaver Builder plugin for WordPress. This allows authenticated attackers with access to the Beaver Builder editor to inject arbitrary web scripts in pages, which will execute whenever a user accesses an injected page. The exploitation of this issue can enable remote attackers to perform cross-site scripting attacks.

Recommendations For versions up to, and including, 2.5.5.2, update to a version that includes the necessary security patches to fix the insufficient input sanitization and output escaping in the 'Text Editor' block. As a temporary workaround, consider restricting access to the 'Text Editor' block in the Beaver Builder editor to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-06380

CVE-2022-2716

Affected Products

Beaver Builder

References · 10

• https://wpbeaverbuilder.com/change-logs · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2716 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2716 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06380 · Security Note
• https://fortiguard.com/zeroday/FG-VD-20-079 · Note
• https://fortiguard.com/zeroday/FG-VD-20-078 · Note
• https://wordfence.com/vulnerability-advisories/#CVE-2022-2716 · Note
• https://github.com/advisories/GHSA-jr5q-879v-77pw · Note
• https://docs.wpbeaverbuilder.com/beaver-builder/layouts/modules/text · Note
• https://t.me/cibsecurity/49366 · Telegram Post