EUVD-2026-32107
GHSA-9xwr-6vrg-3vm6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lvca_admin_ajax AJAX action in all versions up to, and including, 3.9.4 due to missing authorization checks and insufficient input sanitization. The AJAX handler verifies a nonce but does not check user capabilities. This makes it possible for authenticated attackers with Subscriber-level access and above to modify plugin settings and inject malicious scripts that execute when administrators access the plugin settings page or when any user visits the frontend.
AnalysisAI
Stored Cross-Site Scripting in the WPBakery Page Builder Addons by Livemesh WordPress plugin (all versions through 3.9.4) allows authenticated attackers with as little as Subscriber-level access to permanently inject malicious JavaScript into plugin settings via the unprotected lvca_admin_ajax AJAX endpoint. The injected payload executes both when administrators access the plugin settings page and when any frontend visitor loads affected pages, achieving Changed Scope impact beyond the attacker's own session. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE, though the low authentication bar makes it a realistic risk on WordPress sites with open user registration.
Technical ContextAI
The vulnerability exists in the WordPress plugin 'WPBakery Page Builder Addons by Livemesh' (plugin slug: addons-for-visual-composer), which extends the WPBakery Page Builder ecosystem. The root cause is CWE-862 (Missing Authorization): the lvca_admin_ajax AJAX handler at admin/admin-ajax.php line 64 performs nonce verification - correctly preventing CSRF - but entirely omits WordPress capability checks (e.g., current_user_can()). This means any authenticated user, regardless of role, can invoke the handler and write attacker-controlled data into plugin settings (settings.php line 568, helper-functions.php line 256). The stored XSS component arises because that same handler lacks sufficient input sanitization before persisting user-supplied data, which is then rendered unescaped in admin and frontend contexts. The Changed Scope (S:C) in the CVSS vector reflects that the injected script executes in browser sessions of users who did not themselves perform any malicious action - including site administrators - escalating the blast radius well beyond the attacker's own privilege level.
RemediationAI
No vendor-released patched version has been identified at time of analysis - the affected version range is stated as all versions through 3.9.4 with no confirmed successor release cited in the available data. Site administrators should monitor the WordPress plugin repository and the Wordfence advisory at wordfence.com/threat-intel/vulnerabilities/id/ff0d4000-020b-4e22-9362-a8f0f5df321e for a patched release and apply it immediately upon availability. As a compensating control, disable user registration on the WordPress site (Settings > General > Membership) to prevent unauthenticated individuals from obtaining Subscriber accounts; note this may impact legitimate sign-up workflows. Alternatively, deploy a WordPress-aware WAF such as Wordfence or Patchstack to virtually patch the lvca_admin_ajax endpoint by blocking unauthorized AJAX requests from low-privilege roles - this introduces dependency on a third-party plugin but provides near-immediate coverage. Restrict the WordPress admin settings page to trusted IP ranges if the hosting environment permits, limiting the blast radius of any stored payload. Audit existing Subscriber-level accounts for signs of unauthorized AJAX calls in server logs targeting admin-ajax.php with the lvca_admin_ajax action.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today