CVE-2026-3895 Details

A stored cross-site scripting vulnerability has been identified in the WPBakery Page Builder Addons by Livemesh plugin for WordPress, affecting all versions through 3.9.4. The vulnerability arises from missing authorization checks and inadequate input sanitization in the 'lvca_admin_ajax' AJAX action. While the AJAX handler verifies a nonce, it fails to check user capabilities, allowing authenticated attackers with Subscriber-level access and above to alter plugin settings and inject malicious scripts. These scripts execute when administrators access the plugin settings page or when any user visits the frontend.