Junglewise Threat Intelligence

CVE-2026-3897: Livemesh Addons for Beaver Builder Stored XSS in labb_admin_ajax

CVE-2026-3897 · Severity: medium · CVSS 6.4 · Published 2026-05-27

Vendors: Livemesh.

Executive brief

The Livemesh Addons for Beaver Builder plugin for WordPress, which provides additional design elements for the Beaver Builder page editor, contains a security flaw. This vulnerability allows any logged-in user, even those with low-level permissions like subscribers, to change plugin settings and inject malicious code into the website. This could lead to unauthorized actions being performed on behalf of site administrators or the redirection of visitors to malicious websites.

Technical details

The Livemesh Addons for Beaver Builder plugin for WordPress (up to version 3.9.2) is vulnerable to Stored Cross-Site Scripting (XSS) due to a lack of proper authorization and input sanitization in the 'labb_admin_ajax' AJAX action. While the AJAX handler implements nonce verification, it fails to perform capability checks (CWE-862) to ensure the requesting user has administrative privileges. An authenticated attacker with Subscriber-level permissions or higher can exploit this to modify plugin settings and inject arbitrary JavaScript. This payload is then stored and executed in the context of an administrator's browser when they visit the settings page, or in the context of any user visiting the frontend of the site.

Affected products

  • Livemesh Livemesh Addons for Beaver Builder Up to, and including, 3.9.2

Timeline

  • 2026-05-27: disclosed: Initial publication of the CVE record.
  • 2026-05-27: advisory: Wordfence published the vulnerability details.

References