What the vulnerability does
01Description
The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `lvca_admin_ajax` AJAX action in all versions up to, and including, 3.9.4 due to missing authorization checks and insufficient input sanitization. The AJAX handler verifies a nonce but does not check user capabilities. This makes it possible for authenticated attackers with Subscriber-level access and above to modify plugin settings and inject malicious scripts that execute when administrators access the plugin settings page or when any user visits the frontend.
Explanation of Vulnerability in Simple Terms
02Summary
WPBakery Page Builder Addons by Livemesh versions up to 3.9.4 lack proper authorization checks on certain functions. A logged-in user with low privileges can perform actions or access data they should not be able to, potentially affecting other users or site configuration. The vulnerability has a network-wide scope, meaning impacts may extend beyond the plugin itself.
What an attacker can do
03Attacker Capabilities
A low-privilege logged-in user can perform unauthorized actions or access restricted data affecting other users or site settings.
Potential impact on your site
04Site Impact
Unauthorized users may modify content, access sensitive data, or alter site configuration depending on what functions lack authorization checks.
Conditions required to exploit
05Prerequisites
Attacker must have a valid WordPress user account with low-level privileges (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
May 27, 2026
CVE published
May 27, 2026
Record updated
