CVE-2026-18843: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in The Beaver Builder Team Beaver Builder Plugin (Starter Version)

CVE-2026-18843 is a reflected cross-site scripting vulnerability in the Beaver Builder Plugin (Starter Version) for WordPress. It occurs due to improper neutralization of input in the 'no_results_message' node_preview parameter, allowing injection of malicious scripts. This vulnerability affects all plugin versions up to and including 2.11.0.1. Exploitation requires user interaction, such as clicking a malicious link, and can lead to partial confidentiality and integrity impact without affecting availability.

An unauthenticated attacker can inject and execute arbitrary web scripts in the context of the affected site by exploiting the reflected XSS vulnerability. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of displayed content. There is no direct impact on system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid interacting with untrusted links that might exploit this vulnerability. Monitor the vendor's communications for updates on patches or official mitigations.