CVE-2025-3669: Supreme Addons Beaver Builder XSS Flaw

CVE-2025-3669 Overview

CVE-2025-3669 is a Stored Cross-Site Scripting (XSS) vulnerability in the Supreme Addons for Beaver Builder plugin for WordPress. The flaw affects all plugin versions up to and including 1.0.9. It resides in the auto_qrcodesabb shortcode, which fails to properly sanitize user-supplied attributes and escape output. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The payload executes in the browser of any visitor who views an affected page. The weakness is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Contributor-level accounts can persist JavaScript into published pages, enabling session hijacking, redirection, and privilege escalation through administrator interaction.

Affected Products

Supreme Addons for Beaver Builder (Lite) WordPress plugin — versions through 1.0.9
The vulnerable auto_qrcodesabb shortcode in modules/QR-Code/QR-Code.php
WordPress sites allowing contributor-level or higher registration

Discovery Timeline

2025-07-24 - CVE-2025-3669 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3669

Vulnerability Analysis

The vulnerability exists in the plugin's QR code module, which registers the auto_qrcodesabb shortcode. Shortcode attributes passed by authenticated users flow into the rendered HTML output without sanitization or escaping. An attacker with contributor permissions can embed the shortcode with crafted attribute values that include HTML or JavaScript. When an editor or administrator previews, edits, or publishes the post, or when a site visitor loads the published page, the injected script executes in their browser session.

Stored XSS in a WordPress context is impactful because the payload persists in the database and executes under the origin of the target site. An attacker can perform actions on behalf of higher-privileged users, including creating administrator accounts, modifying plugin configuration, or injecting backdoors into theme files.

Root Cause

The root cause is insufficient input validation and missing output escaping within the shortcode handler at modules/QR-Code/QR-Code.php (line 102, per the WordPress Plugin Code Review). The handler does not apply WordPress sanitization functions such as sanitize_text_field() on input, nor escaping functions such as esc_attr() or esc_html() on output.

Attack Vector

Exploitation requires an authenticated session with contributor privileges or higher. The attacker creates or edits a post containing the auto_qrcodesabb shortcode with a malicious attribute value. Because the scope is changed (S:C in the CVSS vector), the executed script runs with the privileges of the viewing user, enabling cross-user compromise. No user interaction beyond normal page viewing is required for the payload to fire. Further details are documented in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-3669

Indicators of Compromise

Posts or pages containing the auto_qrcodesabb shortcode with suspicious attributes such as <script>, onerror=, javascript:, or encoded payload markers.
Unexpected administrator account creation or role changes following edits by contributor-level users.
Outbound requests from editor browser sessions to unknown third-party domains after viewing contributor-authored content.

Detection Strategies

Audit the WordPress wp_posts table for occurrences of auto_qrcodesabb and inspect shortcode attribute values for HTML or script tokens.
Review user role assignments and recent contributor submissions on sites running Supreme Addons for Beaver Builder.
Enable Content Security Policy (CSP) reporting to surface unexpected inline script execution on front-end pages.

Monitoring Recommendations

Monitor WordPress audit logs for post creation and edits by contributor-level accounts.
Alert on new administrator account creation that follows a contributor post edit within a short time window.
Track plugin version inventory to identify sites running Supreme Addons for Beaver Builder at or below version 1.0.9.

How to Mitigate CVE-2025-3669

Immediate Actions Required

Update the Supreme Addons for Beaver Builder plugin to a version later than 1.0.9 as soon as a patched release is available.
Review all existing posts for the auto_qrcodesabb shortcode and remove or sanitize any attributes containing script content.
Audit contributor-level and above accounts, removing or demoting any that are inactive or unverified.

Patch Information

At the time of publication, consult the plugin developer page for the latest fixed release. If no patch is available, deactivate and remove the plugin until a corrected version is published.

Workarounds

Deactivate the Supreme Addons for Beaver Builder plugin until a fixed version is installed.
Restrict contributor registration and require administrator approval for new accounts.
Deploy a web application firewall rule to block requests containing the auto_qrcodesabb shortcode with HTML or script metacharacters in attribute values.

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate supreme-addons-for-beaver-builder-lite
wp plugin delete supreme-addons-for-beaver-builder-lite

# Search the database for the vulnerable shortcode usage
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%auto_qrcodesabb%';"