PatchSiren cyber security CVE debrief

CVE-2026-2030 livemesh CVE debrief

A stored cross-site scripting (XSS) vulnerability in the WPBakery Page Builder Addons by Livemesh WordPress plugin allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. The vulnerability exists in versions up to and including 3.9.4, specifically within the `[lvca_carousel]` and `[lvca_posts_carousel]` shortcodes. The root cause is insufficient input sanitization and output escaping: shortcode attributes are encoded using `wp_json_encode()` and output into single-quoted `data-settings` HTML attributes without applying `esc_attr()`, enabling attackers to break out of the attribute context by injecting single quotes. This allows malicious scripts to execute when any user accesses a page containing the injected content. The vulnerability was published on 2026-05-27 and carries a CVSS 3.1 score of 6.4 (Medium severity).

Vendor: livemesh
Product: WPBakery Page Builder Addons by Livemesh
CVSS: MEDIUM 6.4
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-27
Original CVE updated: 2026-05-27
Advisory published: 2026-05-27
Advisory updated: 2026-05-27

Who should care

WordPress site administrators using WPBakery Page Builder Addons by Livemesh plugin; security teams monitoring WordPress plugin vulnerabilities; developers maintaining sites with Contributor-level user access; compliance teams tracking authenticated XSS exposure in content management systems

Technical summary

The vulnerability stems from improper escaping in two carousel shortcode implementations. The `wp_json_encode()` function produces JSON-encoded output that is placed directly into single-quoted HTML attributes. Without `esc_attr()` wrapping, an attacker can inject a payload like `'};alert(1);//` to break out of the `data-settings` attribute and execute arbitrary JavaScript. The JSON encoding does not provide sufficient context-aware escaping for HTML attribute contexts, particularly when single quotes are used as attribute delimiters.

Defensive priority

medium

Recommended defensive actions

Update WPBakery Page Builder Addons by Livemesh plugin to version 3.9.5 or later if available
Review and audit all posts and pages for unauthorized use of `[lvca_carousel]` or `[lvca_posts_carousel]` shortcodes, particularly those containing suspicious single-quote patterns or encoded payloads
Implement Content Security Policy (CSP) headers to mitigate impact of any unpatched XSS vectors
Restrict Contributor-level access to trusted users only until patching is complete
Consider using WordPress security plugins with XSS filtering capabilities as a defense-in-depth measure
Review web server access logs for unusual patterns of shortcode usage or encoded payload submissions

Evidence notes

Vulnerability confirmed via Wordfence security advisory and WordPress plugin source code references. CWE-79 (Improper Neutralization of Input During Web Page Generation) identified as primary weakness. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.

Sources and references

Verified primary and authoritative sources

CVE-2026-2030 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-2030

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-2030 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-2030

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://plugins.trac.wordpress.org/browser/addons-for-visual-composer/tags/3.9.4/includes/addons/carousel/class-lvca-carousel.php

[email protected]
Source reference
Unverified legacy reference

URL: https://plugins.trac.wordpress.org/browser/addons-for-visual-composer/tags/3.9.4/includes/addons/posts-carousel/class-lvca-posts-carousel.php

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.