Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-92084 · Microsoft / collected KEV context

cve-program · CVE-2026-92084

• https://www.wordfence.com/threat-intel/vulnerabilities/id/794e6d9b-ac07-4261-a60d-81c474973005?source=cve
• https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/tags/2.11.0.5/classes/class-fl-builder.php#L2139
• https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/tags/2.11.0.5/modules/sidebar/sidebar.php#L11
• https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/tags/2.11.0.5/modules/sidebar/includes/frontend.php#L4
• https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/tags/2.11.0.5/classes/class-fl-builder-module.php#L143
• https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/tags/2.11.0.5/classes/class-fl-builder.php#L2264
• https://plugins.trac.wordpress.org/changeset/3713226/beaver-builder-lite-version/trunk/modules/sidebar/sidebar.php

No related operational record is retained in the current change model.