CVE-2022-2695

The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter added to images via the media uploader in versions up to, and including, 2.5.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with access to the Beaver Builder editor and the ability to upload media files to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79
• CWE-79

• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2695Third Party Advisory
• https://www.wpbeaverbuilder.com/change-logs/Release Notes, Vendor Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2695Third Party Advisory
• https://www.wpbeaverbuilder.com/change-logs/Release Notes, Vendor Advisory

Published

Sep 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26943The Motorola MTM5000 series firmwares generate TETRA authent…8.8
• CVE-2022-26944Percona XtraBackup 2.4.20 unintentionally writes the command…6.5
• CVE-2022-26945go-getter up to 1.5.11 and 2.0.2 allowed protocol switching,…9.8
• CVE-2022-26947Archer 6.x through 6.9 SP3 (6.9.3.0) contains a reflected XS…5.4
• CVE-2022-26948The Archer RSS feed integration for Archer 6.x through 6.9 S…7.5
• CVE-2022-26949Archer 6.x through 6.9 SP2 P1 (6.9.2.1) contains an improper…6.5
• CVE-2022-26950Archer 6.x through 6.9 P2 (6.9.0.2) is affected by an open r…6.1
• CVE-2022-26951Archer 6.x through 6.10 (6.10.0.0) contains a reflected XSS …6.1
• CVE-2022-26952Digi Passport Firmware through 1.5.1,1 is affected by a buff…7.5
• CVE-2022-26953Digi Passport Firmware through 1.5.1,1 is affected by a buff…7.5
• CVE-2022-26954Multiple open redirect vulnerabilities in NopCommerce 4.10 t…6.1
• CVE-2022-26959There are two full (read/write) Blind/Time-based SQL injecti…9.8