{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-18T07:51:03.265","vulnerabilities":[{"cve":{"id":"CVE-2022-2517","sourceIdentifier":"security@wordfence.com","published":"2022-09-06T18:15:14.193","lastModified":"2024-11-21T07:01:09.557","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Caption - On Hover' value associated with images in versions up to, and including, 2.5.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with access to the Beaver Builder editor to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."},{"lang":"es","value":"El Beaver Builder - WordPress Page Builder para WordPress es vulnerable a un ataque de tipo Cross-Site Scripting Almacenado por medio del valor \"Caption - On Hover\" asociado a las imágenes en versiones hasta, e incluyendo, la 2.5.5.2 debido a la insuficiente sanitización de la entrada y escape de la salida. Esto hace posible a atacantes autenticados con acceso al editor Beaver Builder inyecten scripts web arbitrarios en las páginas que ejecutarán cada vez que un usuario acceda a una página inyectada."}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:fastlinemedia:beaver_builder:*:*:*:*:lite:wordpress:*:*","versionEndIncluding":"2.5.5.2","matchCriteriaId":"6C244DF2-0D5D-4D41-B8C2-228F2B8CD558"}]}]}],"references":[{"url":"https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2517","source":"security@wordfence.com","tags":["Third Party Advisory"]},{"url":"https://www.wpbeaverbuilder.com/change-logs/","source":"security@wordfence.com","tags":["Product","Release Notes"]},{"url":"https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2517","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.wpbeaverbuilder.com/change-logs/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product","Release Notes"]}]}}]}