CVE-2026-18021

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.10.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

• CWE-94

• https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/trunk/classes/class-fl-builder.php#L2018
• https://plugins.trac.wordpress.org/changeset/3645247/beaver-builder-lite-version/tags/2.10.3.2
• https://www.wordfence.com/threat-intel/vulnerabilities/id/95f2af83-2667-49e1-8890-99559cd90ec4?source=cve

Published

Sep 8, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18016Insufficient policy enforcement in Chrome for iOS in Google …4.3
• CVE-2026-18017Use after free in Dawn in Google Chrome prior to 151.0.7922.…8.8
• CVE-2026-18018Inappropriate implementation in Updater in Google Chrome on …4
• CVE-2026-18019Side-channel information leakage in Media in Google Chrome p…4.3
• CVE-2026-1802A security flaw has been discovered in Ziroom ZHOME A0101 1.…7.3
• CVE-2026-18020IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker t…5.3
• CVE-2026-18022Integer wraparound in IVFFlat index build in pgvector before…8.8
• CVE-2026-18023Sensitive Information in Resource Not Removed Before Reuse i…5.7
• CVE-2026-18024Buffer over-read in PostgreSQL ascii() SQL function allows a…4.3
• CVE-2026-18027The WebToffee WooCommerce PDF Invoices, Packing Slips, Deliv…6.5
• CVE-2026-18028The "quick setup" view presented to users after they first c…2.3
• CVE-2026-18029Our payment integration with GiroCheckout did not properly v…6.3