CVE-2022-2695: 
WordPress vulnerability analysis and mitigation

The Beaver Builder – WordPress Page Builder plugin for WordPress was found to contain a Stored Cross-Site Scripting vulnerability (CVE-2022-2695) in versions up to and including 2.5.5.2. The vulnerability exists in the 'caption' parameter when adding images via the media uploader, due to insufficient input sanitization and output escaping (NVD).

The vulnerability is classified as a CWE-79 (Cross-site Scripting) type weakness with a CVSS v3.1 score of 5.4 (Medium) (Wordfence, NVD). The issue specifically affects the media uploader functionality where authenticated attackers with access to the Beaver Builder editor and media upload permissions could inject malicious scripts through image captions.

When exploited, this vulnerability allows authenticated attackers with appropriate permissions to inject arbitrary web scripts into pages. These scripts would execute whenever a user accesses the affected page, potentially leading to unauthorized actions or data theft (NVD).

The vulnerability was patched in version 2.5.5.3 of the Beaver Builder plugin. Users are advised to update to this or a later version to protect against this security issue (Wordfence).