CVE-2025-8897

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8897", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-12T17:40:00.527Z", "datePublished": "2025-08-28T01:46:29.543Z", "dateUpdated": "2026-04-08T17:09:39.249Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:39.249Z"}, "affected": [{"vendor": "beaverbuilder", "product": "Beaver Builder Page Builder \u2013 Drag and Drop Website Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.9.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Beaver Builder \u2013 WordPress Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018'fl_builder' parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "Beaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93504959-2154-4b8c-a7d1-c982bdc8d034?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3350565/beaver-builder-lite-version/trunk/includes/ui-iframe.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jack Pas"}], "timeline": [{"time": "2025-08-12T17:55:13.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-08-27T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-28T14:24:31.381771Z", "id": "CVE-2025-8897", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-28T14:24:37.797Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8897", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-28T14:24:31.381771Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-28T14:24:34.582Z"}}], "cna": {"title": "Beaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Jack Pas"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "beaverbuilder", "product": "Beaver Builder Page Builder \u2013 Drag and Drop Website Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.9.2.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-12T17:55:13.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-08-27T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93504959-2154-4b8c-a7d1-c982bdc8d034?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3350565/beaver-builder-lite-version/trunk/includes/ui-iframe.php"}], "descriptions": [{"lang": "en", "value": "The Beaver Builder \u2013 WordPress Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018'fl_builder' parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:39.249Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8897", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:09:39.249Z", "dateReserved": "2025-08-12T17:40:00.527Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-28T01:46:29.543Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Beaver Builder Page Builder \u2013 Drag and Drop Website Builder", "vendor": "beaverbuilder", "versions": [{"lessThanOrEqual": "2.9.2.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fastlinemedia:beaver_builder:*:*:*:*:lite:wordpress:*:*", "matchCriteriaId": "C6855B02-DBE6-4FAD-99FB-E8DF330357B8", "versionEndIncluding": "2.9.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Beaver Builder \u2013 WordPress Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018'fl_builder' parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Beaver Builder - WordPress Page Builder para WordPress es vulnerable a Cross-Site Scripting Reflejado a trav\u00e9s del par\u00e1metro 'fl_builder' en todas las versiones hasta, e incluyendo, la 2.9.2.1 debido a una insuficiente sanitizaci\u00f3n de entrada y escape de salida. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutan si logran enga\u00f1ar con \u00e9xito a un usuario para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-8897", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8897", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-28T14:24:31.381771Z", "version": "2.0.3"}}]}, "published": "2025-08-28T03:15:38.333", "references": [{"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3350565/beaver-builder-lite-version/trunk/includes/ui-iframe.php"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93504959-2154-4b8c-a7d1-c982bdc8d034?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:20:51.874992+00:00", "value": {"mitigation_remediation": ["Upgrade the Beaver Builder plugin to the latest version (any release newer than 2.9.2.1).", "If an upgrade is not immediately possible, block or strip the 'fl_builder' GET parameter using a web application firewall or server configuration rule to prevent malicious input from reaching the plugin.", "If the plugin is not required, remove or disable it from the WordPress installation to eliminate the risk entirely."], "summary": {"action": "Apply Patch", "impact": "Reflected Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Vulnerable systems are installations of the Beaver Builder Lite Page Builder \u2013 Drag and Drop Website Builder for WordPress. Versions 2.9.2.1 and older are affected; any deployment of the plugin without an update beyond this release is at risk. The vulnerability is tied to the plugin\u2019s core code and not to the underlying WordPress platform itself.", "description_and_impact": "The Beaver Builder \u2013 WordPress Page Builder plugin for WordPress is vulnerable to reflected cross\u2011site scripting through the 'fl_builder' GET parameter. In all versions up to and including 2.9.2.1 the plugin does not properly sanitize or escape user\u2011supplied input, allowing an attacker to embed arbitrary JavaScript that will run in the context of a victim\u2019s browser when the victim follows a crafted link or clicks a malicious button. This flaw can lead to theft of session cookies, defacement of content, or execution of additional malicious code on the victim\u2019s machine.", "risk_and_exploitability": "The CVSS score of 6.1 places the weakness in the moderate severity range, but the EPSS score of less than 1% indicates that it is currently not widely exploited. The flaw is remote, unauthenticated, and does not require any prior access; an attacker only needs to lure a user to a URL containing a malicious 'fl_builder' value. The vulnerability is not listed in CISA\u2019s KEV catalog, suggesting no widespread active exploitation as of now. Nonetheless, the impact to a business that relies on the plugin is high if an attacker succeeds in compromising a user\u2019s session or injecting malware through the site."}}}}, "created": "2026-04-21T03:30:26.331685+00:00", "updated": "2026-04-21T03:30:26.331696+00:00", "vendors": []}