CVE-2026-3895mediumCWE-862

CVE-2026-3895: falha de média gravidade em livemesh WPBakery Page Builder Addons by…

WPBakery Page Builder Addons by Livemesh <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

Publicada em

Seguir esta CVE+ Monitorar WPBakery Page Builder Addons by Livemesh

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.4epss 0.2%
The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `lvca_admin_ajax` AJAX action in all versions up to, and including, 3.9.4 due to missing authorization checks and insufficient input sanitization. The AJAX handler verifies a nonce but does not check user capabilities. This makes it possible for authenticated attackers with Subscriber-level access and above to modify plugin settings and inject malicious scripts that execute when administrators access the plugin settings page or when any user visits the frontend.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Produtos afetados
livemesh · WPBakery Page Builder Addons by Livemesh
CVEs relacionadas — livemesh WPBakery Page Builder Addons by…

No mesmo produto, das mais perigosas para as menos.

CVE-2022-4974MEDIUMFreemius SDK <= 2.4.2 - Missing Authorization ChecksEPSS 0.4%CVE-2024-2079MEDIUMWPBakery Page Builder Addons by Livemesh <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2026-2030MEDIUMWPBakery Page Builder Addons by Livemesh <= 3.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%