CVE-2026-18843
🔶 mediumSummary
The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter in all versions up to, and including, 2.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score
6.1
Medium
EPSS Score
0.2
Exploit Probability
Published Date
2026-09-05
First Seen: 2026-09-06
📊 Relative Risk Intelligence
This CVE is Lower Risk - more severe than 37.7% of all 353,061 vulnerabilities in our database.
#220,116
Below average severity
Severity Percentile
Last Modified
2026-09-05
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE IDs (Weakness Types)