CVE-2026-3896 Details

A stored cross-site scripting vulnerability has been identified in the Livemesh SiteOrigin Widgets plugin for WordPress, affecting all versions through 3.9.2. The issue arises from missing authorization checks and inadequate input sanitization in the 'lsow_admin_ajax' AJAX action. While the AJAX handler verifies a nonce, it fails to check user capabilities, allowing authenticated attackers with Subscriber-level access and above to alter plugin settings and inject malicious scripts. These scripts execute when administrators access the plugin settings page or when any user visits the frontend.