CVE-2022-2716

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Editor' block in versions up to, and including, 2.5.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with access to the Beaver Builder editor to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-271619.8Csz Cms 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_viewUsers CVE-2022-271629.8CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_editUser CVE-2022-271639.8CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_editUser CVE-2022-271649.8CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_viewUsers CVE-2022-271659.8CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Plugin_manager_setstatus CVE-2022-271666.1A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which cou CVE-2022-271677.1Privilege escalation vulnerability in Windows products of ESET, spol. s r.o. allows attacker to exploit "Repair" and "Uninstall" features wh CVE-2022-271686.1Cross-site scripting vulnerability in LiteCart versions prior to 2.4.2 allows a remote attacker to inject an arbitrary script via unspecifie CVE-2022-271697.5An information disclosure vulnerability exists in the OAS Engine SecureBrowseFile functionality of Open Automation Software OAS Platform V16 CVE-2022-27174.9The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' par CVE-2022-271707.8Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable CVE-2022-271728.8A hard-coded password vulnerability exists in the console infactory functionality of InHand Networks InRouter302 V3.5.37. A specially-crafte