Beaver Builder WordPress Plugin Arbitrary Shortcode Execution Vulnerability

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution.

• Affects all versions up to, and including, 2.11.0.5.
• Due to an action that does not properly validate a value before running do_shortcode.
• Allows unauthenticated attackers to execute arbitrary shortcodes.
• Requires a Beaver Builder page containing the Sidebar module populated with a widget that displays attacker-controllable text, such as the core Recent Comments widget.
• Requires comment moderation to be disabled or the attacker's comment to be approved.