Beaver Builder vulnerabilities

The Beaver Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 2.10.3.1 due to improper validation before running do_shortcode. This allows unauthenticated attackers to execute arbitrary shortcodes.

The Beaver Builder plugin for WordPress up to version 2.11.0.5 is vulnerable to blind SQL injection via the 'fields[][value]' parameter. Authenticated attackers with contributor-level access can modify SQL queries and extract sensitive data from the database.

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via the 'get_attachment_sizes' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the path and meta data of private attachments, which can be used to view the attachments.