Stored Cross-Site Scripting in Livemesh Addons for Beaver Builder Plugin by WordPress

CVE-2026-3897

What is CVE-2026-3897?

The Livemesh Addons for Beaver Builder plugin for WordPress features a vulnerability due to insufficient authorization checks in its AJAX handling. Specifically, the labb_admin_ajax action permits authenticated users with Subscriber-level access or higher to inject malicious scripts. This occurs because, while a nonce verification is in place, the system fails to adequately check user capabilities. Attackers can exploit this flaw to manipulate plugin settings, enabling script execution either when administrators access the plugin settings or when any user interacts with the frontend.

References