{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3669", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-15T21:21:31.036Z", "datePublished": "2025-07-24T09:22:19.735Z", "dateUpdated": "2026-04-08T17:06:45.764Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:45.764Z"}, "affected": [{"vendor": "ullakalim8", "product": "Supreme Addons for Beaver Builder \u2013", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Supreme Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's auto_qrcodesabb shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Supreme Addons for Beaver Builder <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_qrcodesabb Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/904ba3ec-efde-424c-a50b-2ce71ad91ca5?source=cve"}, {"url": "https://wordpress.org/plugins/supreme-addons-for-beaver-builder-lite/#developers"}, {"url": "https://plugins.trac.wordpress.org/browser/supreme-addons-for-beaver-builder-lite/tags/1.0.9/modules/QR-Code/QR-Code.php#L102"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "timeline": [{"time": "2025-07-23T20:52:24.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-24T13:14:33.219643Z", "id": "CVE-2025-3669", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-24T13:14:37.205Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3669", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-24T13:14:33.219643Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-24T13:14:34.848Z"}}], "cna": {"title": "Supreme Addons for Beaver Builder <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_qrcodesabb Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "ullakalim8", "product": "Supreme Addons for Beaver Builder \u2013", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-23T20:52:24.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/904ba3ec-efde-424c-a50b-2ce71ad91ca5?source=cve"}, {"url": "https://wordpress.org/plugins/supreme-addons-for-beaver-builder-lite/#developers"}, {"url": "https://plugins.trac.wordpress.org/browser/supreme-addons-for-beaver-builder-lite/tags/1.0.9/modules/QR-Code/QR-Code.php#L102"}], "descriptions": [{"lang": "en", "value": "The Supreme Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's auto_qrcodesabb shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-07-24T09:22:19.735Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3669", "state": "PUBLISHED", "dateUpdated": "2025-07-24T13:14:37.205Z", "dateReserved": "2025-04-15T21:21:31.036Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-24T09:22:19.735Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Supreme Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's auto_qrcodesabb shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Supreme Addons for Beaver Builder para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s del shortcode auto_qrcodesabb del complemento en todas las versiones hasta la 1.0.9 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-3669", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-07-24T10:15:26.273", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/supreme-addons-for-beaver-builder-lite/tags/1.0.9/modules/QR-Code/QR-Code.php#L102"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/supreme-addons-for-beaver-builder-lite/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/904ba3ec-efde-424c-a50b-2ce71ad91ca5?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T01:00:49.315774+00:00", "value": {"mitigation_remediation": ["Upgrade Supreme Addons for Beaver Builder to the latest released version that removes the vulnerable shortcode handling.", "If an upgrade cannot be performed immediately, revoke Contributor or higher privileges for users who have not been verified, or block the auto_qrcodesabb shortcode on existing content until a patch is applied.", "Deploy a web application firewall or content security policy that blocks or sanitizes unexpected script tags entered through shortcode attributes.", "Regularly scan site content for lingering malicious scripts and remove any that are discovered."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Version 1.0.9 and all earlier releases of the Supreme Addons for Beaver Builder plugin for WordPress, developed by ullakalim8, are affected. The flaw is present in the auto_qrcodesabb shortcode shipped with these releases.", "description_and_impact": "The Supreme Addons for Beaver Builder plugin for WordPress contains an input validation weakness in its auto_qrcodesabb shortcode. Unsanitized, user\u2011supplied attributes are stored and later rendered without proper escaping, enabling the injection of arbitrary JavaScript. When an authenticated contributor or higher user deploys the shortcode with crafted attributes, the malicious script becomes part of the page content and will execute in the browsers of any visitor who loads the affected page, potentially giving an attacker access to session cookies, defacing content, or executing further actions on behalf of the victim.", "risk_and_exploitability": "The CVSS base score of 6.4 places this vulnerability in the medium severity range. The EPSS score of less than 1% indicates that the likelihood of exploitation is currently very low, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known weaponized exploit. An attacker must first authenticate to the WordPress site with a role of Contributor or greater to inject the payload, implying that internal credentials or compromised accounts are required. Once injected, the cross\u2011site scripting can affect any user who views the compromised page, posing a threat to confidentiality, integrity, and availability of the affected WordPress site."}}}}, "created": "2026-04-22T01:15:07.296952+00:00", "updated": "2026-04-22T01:15:07.296972+00:00", "vendors": []}