# CVE-2026-2030: Livemesh WPBakery Page Builder Addons Stored XSS in Carousel Shortcodes

Source: https://junglewise.ai/threats/cve-2026-2030-livemesh-wpbakery-page-builder-addons-stored-xss-in-carousel  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-2030 · Severity: medium · CVSS 6.4 · Published 2026-05-27

The WPBakery Page Builder Addons by Livemesh plugin for WordPress, which provides additional design elements for website building, contains a security flaw. This vulnerability allows users with basic contributor-level access to inject malicious scripts into website pages. When other visitors or administrators view these pages, the scripts can execute, potentially leading to unauthorized actions or data theft.

Vendors: [Livemesh](https://junglewise.ai/threats/vendors/livemesh).

## Quick answers

**Is CVE-2026-2030 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2030 being exploited in the wild.

**How severe is CVE-2026-2030?** Medium severity, with a CVSS score of 6.4, published 27 May 2026.

**Which products and versions are affected?** Livemesh WPBakery Page Builder Addons Up to, and including, 3.9.4.

**Is there a fix for CVE-2026-2030?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-2030 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-2030?** Check whether you run Livemesh WPBakery Page Builder Addons at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the `[lvca_carousel]` and `[lvca_posts_carousel]` shortcodes. Specifically, shortcode attributes are processed using `wp_json_encode()` and placed into single-quoted `data-settings` HTML attributes without the use of `esc_attr()`. This allows an authenticated attacker with Contributor-level permissions or higher to break out of the HTML attribute by injecting single quotes and execute arbitrary JavaScript in the context of a user's browser. The vulnerability affects all versions up to and including 3.9.4.

## Affected products

- Livemesh WPBakery Page Builder Addons by Livemesh Up to, and including, 3.9.4

## Timeline

- 2026-05-27: disclosed: Vulnerability published to NVD
- 2026-05-27: advisory: Wordfence advisory published

## References

- [https://plugins.trac.wordpress.org/browser/addons-for-visual-composer/tags/3.9.4/includes/addons/carousel/class-lvca-carousel.php](https://plugins.trac.wordpress.org/browser/addons-for-visual-composer/tags/3.9.4/includes/addons/carousel/class-lvca-carousel.php)
- [https://plugins.trac.wordpress.org/browser/addons-for-visual-composer/tags/3.9.4/includes/addons/posts-carousel/class-lvca-posts-carousel.php](https://plugins.trac.wordpress.org/browser/addons-for-visual-composer/tags/3.9.4/includes/addons/posts-carousel/class-lvca-posts-carousel.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/ac1493dc-a90a-4427-a631-af5da65e1d6c?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/ac1493dc-a90a-4427-a631-af5da65e1d6c?source=cve)

## Related threats

- [Livemesh WPBakery Page Builder Addons Stored XSS in lvca_admin_ajax](https://junglewise.ai/threats/cve-2026-3895-livemesh-wpbakery-page-builder-addons-stored-xss-in-lvca-admin)