EUVD-2026-32104
GHSA-jjjg-fqrc-825x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [lvca_carousel] and [lvca_posts_carousel] shortcode attributes in all versions up to, and including, 3.9.4 due to insufficient input sanitization and output escaping. Specifically, shortcode attributes are encoded with wp_json_encode() and output into single-quoted data-settings HTML attributes without using esc_attr(), allowing attackers to break out of the attribute by injecting single quotes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored XSS in WPBakery Page Builder Addons by Livemesh (all versions through 3.9.4) allows authenticated WordPress contributors to inject persistent JavaScript into site pages via malformed shortcode attributes on the [lvca_carousel] and [lvca_posts_carousel] shortcodes. The flaw arises from using wp_json_encode() instead of esc_attr() when embedding shortcode attributes into single-quoted HTML data-settings attributes, enabling an attacker to inject a literal single quote and escape the attribute boundary. No public exploit identified at time of analysis; EPSS of 0.03% (9th percentile) reflects low current exploitation interest, and the practical attack surface is constrained to WordPress sites where untrusted users hold Contributor-level access.
Technical ContextAI
The plugin (WordPress slug: addons-for-visual-composer) processes user-supplied shortcode attributes by serializing them with wp_json_encode() and writing the output directly into single-quoted HTML data-settings attributes. wp_json_encode() applies JSON encoding conventions, which do not escape the single-quote character (U+0027); esc_attr(), the correct WordPress function for HTML attribute contexts, would percent-encode or HTML-entity-encode single quotes to prevent boundary escape. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) precisely describes this output-context mismatch: the sanitization applied is appropriate for a different output context (JSON) than the one actually used (HTML attribute). The vulnerable logic is confirmed at line 55 of includes/addons/carousel/class-lvca-carousel.php and line 113 of includes/addons/posts-carousel/class-lvca-posts-carousel.php in the 3.9.4 release tag, as referenced via WordPress Trac source browsing.
RemediationAI
No patched version is identified from the available input data - the fix version is unknown and not independently confirmed. Administrators should check the WordPress.org plugin page for addons-for-visual-composer and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ac1493dc-a90a-4427-a631-af5da65e1d6c for a released update, and upgrade immediately if one is available. If no patch has been released, the most effective compensating control is to audit and restrict Contributor-level role assignments to fully trusted individuals only, since the exploit requires at minimum Contributor access - sites that grant this role freely or allow open registration are most exposed. A targeted workaround is to disable or remove the WPBakery Page Builder Addons by Livemesh plugin entirely until a patched version is confirmed, accepting the trade-off of losing carousel functionality. Sites running the Wordfence security plugin should verify their firewall rule set is current, as Wordfence typically deploys virtual patches for vulnerabilities it discovers. Blocking the [lvca_carousel] and [lvca_posts_carousel] shortcodes via a shortcode-restriction plugin is an additional surgical control if full plugin removal is not feasible.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today