What is the CVSS score of CVE-2026-3896?

CVE-2026-3896 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

SiteOrigin Widgets CVE-2026-3896

EUVD-2026-32102 MEDIUM

Missing Authorization (CWE-862)

2026-05-27 security@wordfence.com

GHSA-6jw7-72vv-cg3r

XSS WordPress Authentication Bypass

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:19 vuln.today

CVE Published

May 27, 2026 - 08:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Livemesh SiteOrigin Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lsow_admin_ajax AJAX action in all versions up to, and including, 3.9.2 due to missing authorization checks and insufficient input sanitization. The AJAX handler verifies a nonce but does not check user capabilities. This makes it possible for authenticated attackers with Subscriber-level access and above to modify plugin settings and inject malicious scripts that execute when administrators access the plugin settings page or when any user visits the frontend.

AnalysisAI

Stored Cross-Site Scripting in the Livemesh SiteOrigin Widgets WordPress plugin (all versions through 3.9.2) allows any authenticated subscriber-level user to permanently inject malicious scripts into plugin settings via the unprotected lsow_admin_ajax AJAX endpoint. The injected payload executes against administrators when they access the plugin settings page, and against any site visitor on the frontend - enabling session hijacking, credential theft, or unauthorized admin actions. No public exploit has been identified at time of analysis and CISA has not added this to the KEV catalog, but the low privilege bar (subscriber) makes it an attractive target on sites with open registration.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization) compounded by insufficient input sanitization in the WordPress plugin's AJAX handler. The lsow_admin_ajax action (defined in admin/admin-ajax.php at line 65) implements a nonce check to confirm request origin but omits WordPress capability checks (e.g., current_user_can()), which is the standard mechanism for restricting AJAX actions to specific user roles. A nonce alone only proves the request was initiated from the site - it does not establish authorization level. The unsanitized input is then written to plugin settings (admin/views/settings.php at line 107) and processed through helper-functions.php (line 235), creating a persistent storage vector. Because CVSS Scope is Changed (S:C), the injected payload can cross security boundaries - from a low-privilege subscriber context into the administrator's browser session. Affected CPE covers Livemesh SiteOrigin Widgets versions 0 through 3.9.2 as catalogued by ENISA EUVD-2026-32102.

RemediationAI

No vendor-released patched version has been identified at time of analysis - the only referenced code artifacts point to the vulnerable 3.9.2 tag in the WordPress plugin repository. Site administrators should monitor the WordPress.org plugin page and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/a1510984-571b-49ce-9e10-129e2a1aca7b?source=cve) for a patched release and upgrade immediately when one becomes available. As a compensating control, disable open user registration on WordPress sites where it is not required (Settings > General > uncheck 'Anyone can register') - this eliminates the subscriber-level access vector for unauthenticated external attackers. Additionally, deploying a web application firewall rule targeting the lsow_admin_ajax AJAX action (e.g., via Wordfence or a network WAF) can block exploitation attempts, though this may break legitimate plugin functionality. Audit existing plugin settings for unexpected script content as a sign of prior compromise. Note: deactivating the plugin entirely eliminates the attack surface while awaiting a patch, at the cost of losing widget functionality.