# CVE-2026-3897: Livemesh Addons for Beaver Builder Stored XSS in labb_admin_ajax

Source: https://junglewise.ai/threats/cve-2026-3897-livemesh-addons-for-beaver-builder-stored-xss-in-labb-admin-ajax  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-3897 · Severity: medium · CVSS 6.4 · Published 2026-05-27

The Livemesh Addons for Beaver Builder plugin for WordPress, which provides additional design elements for the Beaver Builder page editor, contains a security flaw. This vulnerability allows any logged-in user, even those with low-level permissions like subscribers, to change plugin settings and inject malicious code into the website. This could lead to unauthorized actions being performed on behalf of site administrators or the redirection of visitors to malicious websites.

Vendors: [Livemesh](https://junglewise.ai/threats/vendors/livemesh).

## Quick answers

**Is CVE-2026-3897 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3897 being exploited in the wild.

**How severe is CVE-2026-3897?** Medium severity, with a CVSS score of 6.4, published 27 May 2026.

**Which products and versions are affected?** Livemesh Addons for Beaver Builder Up to, and including, 3.9.2.

**Is there a fix for CVE-2026-3897?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-3897 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-3897?** Check whether you run Livemesh Addons for Beaver Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Livemesh Addons for Beaver Builder plugin for WordPress (up to version 3.9.2) is vulnerable to Stored Cross-Site Scripting (XSS) due to a lack of proper authorization and input sanitization in the 'labb_admin_ajax' AJAX action. While the AJAX handler implements nonce verification, it fails to perform capability checks (CWE-862) to ensure the requesting user has administrative privileges. An authenticated attacker with Subscriber-level permissions or higher can exploit this to modify plugin settings and inject arbitrary JavaScript. This payload is then stored and executed in the context of an administrator's browser when they visit the settings page, or in the context of any user visiting the frontend of the site.

## Affected products

- Livemesh Livemesh Addons for Beaver Builder Up to, and including, 3.9.2

## Timeline

- 2026-05-27: disclosed: Initial publication of the CVE record.
- 2026-05-27: advisory: Wordfence published the vulnerability details.

## References

- [https://plugins.trac.wordpress.org/browser/addons-for-beaver-builder/tags/3.9.2/admin/admin-ajax.php](https://plugins.trac.wordpress.org/browser/addons-for-beaver-builder/tags/3.9.2/admin/admin-ajax.php)
- [https://plugins.trac.wordpress.org/browser/addons-for-beaver-builder/tags/3.9.2/admin/views/settings.php](https://plugins.trac.wordpress.org/browser/addons-for-beaver-builder/tags/3.9.2/admin/views/settings.php)
- [https://plugins.trac.wordpress.org/browser/addons-for-beaver-builder/tags/3.9.2/includes/helper-functions.php](https://plugins.trac.wordpress.org/browser/addons-for-beaver-builder/tags/3.9.2/includes/helper-functions.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/8bc41c61-1d8a-445f-bd70-3b14a40c89d4?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/8bc41c61-1d8a-445f-bd70-3b14a40c89d4?source=cve)