What the vulnerability does
01Description
The Livemesh SiteOrigin Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `lsow_admin_ajax` AJAX action in all versions up to, and including, 3.9.2 due to missing authorization checks and insufficient input sanitization. The AJAX handler verifies a nonce but does not check user capabilities. This makes it possible for authenticated attackers with Subscriber-level access and above to modify plugin settings and inject malicious scripts that execute when administrators access the plugin settings page or when any user visits the frontend.
Explanation of Vulnerability in Simple Terms
02Summary
Livemesh SiteOrigin Widgets versions 3.9.2 and earlier lack proper authorization checks, allowing authenticated users with low privileges to read and modify data they should not access. The vulnerability affects multiple components due to scope change. Site administrators should update to a version newer than 3.9.2 to prevent unauthorized data exposure and modification.
What an attacker can do
03Attacker Capabilities
Read and modify data belonging to other users or site sections without proper authorization.
Potential impact on your site
04Site Impact
Authenticated users can access and alter sensitive data across your site beyond their intended permissions.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege authenticated account on the site.
Key dates
06Disclosure timeline
May 27, 2026
CVE published
May 27, 2026
Record updated
