What the vulnerability does
01Description
The Livemesh Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `labb_admin_ajax` AJAX action in all versions up to, and including, 3.9.2 due to missing authorization checks and insufficient input sanitization. The AJAX handler verifies a nonce but does not check user capabilities. This makes it possible for authenticated attackers with Subscriber-level access and above to modify plugin settings and inject malicious scripts that execute when administrators access the plugin settings page or when any user visits the frontend.
Explanation of Vulnerability in Simple Terms
02Summary
Livemesh Addons for Beaver Builder versions 3.9.2 and earlier lack proper authorization checks, allowing authenticated users to read or modify data they should not have access to. The vulnerability affects multiple components and can impact other users' information. Site administrators should update to a version newer than 3.9.2 as soon as possible.
What an attacker can do
03Attacker Capabilities
Read or modify other users' data without proper authorization.
Potential impact on your site
04Site Impact
Authenticated users can access or change sensitive data belonging to other users or site settings.
Conditions required to exploit
05Prerequisites
Attacker must have a low-level user account on the site; no user interaction required.
Key dates
06Disclosure timeline
May 27, 2026
CVE published
May 27, 2026
Record updated
