CVE-2026-17090 is a stored cross-site scripting vulnerability in the Beaver Builder Page Builder – Drag and Drop Website Builder WordPress plugin. The flaw exists in the Button Module's 'button' setting, where input is not properly sanitized or escaped before being rendered on web pages. Authenticated attackers with author-level or higher privileges (due to WordPress roles with edit_posts capability) can inject arbitrary scripts that execute in the context of users visiting the compromised pages. This vulnerability affects all versions up to and including 2.10.2.2.

An attacker with author-level access or higher can inject malicious JavaScript code into pages via the vulnerable Button Module setting. This code executes in the browsers of users who view the infected pages, potentially leading to session hijacking, privilege escalation, or other attacks that leverage the victim's browser context. The vulnerability does not affect availability but impacts confidentiality and integrity of user sessions and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access to trusted users only and consider disabling or limiting use of the Button Module 'button' setting. Monitor vendor channels for updates and apply patches promptly once released.