PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-2030 livemesh CVE debrief

A stored cross-site scripting (XSS) vulnerability in the WPBakery Page Builder Addons by Livemesh WordPress plugin allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. The vulnerability exists in versions up to and including 3.9.4, specifically within the `[lvca_carousel]` and `[lvca_posts_carousel]` shortcodes. The root cause is insufficient input sanitization and output escaping: shortcode attributes are encoded using `wp_json_encode()` and output into single-quoted `data-settings` HTML attributes without applying `esc_attr()`, enabling attackers to break out of the attribute context by injecting single quotes. This allows malicious scripts to execute when any user accesses a page containing the injected content. The vulnerability was published on 2026-05-27 and carries a CVSS 3.1 score of 6.4 (Medium severity).

Vendor
livemesh
Product
WPBakery Page Builder Addons by Livemesh
CVSS
MEDIUM 6.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

WordPress site administrators using WPBakery Page Builder Addons by Livemesh plugin; security teams monitoring WordPress plugin vulnerabilities; developers maintaining sites with Contributor-level user access; compliance teams tracking authenticated XSS exposure in content management systems

Technical summary

The vulnerability stems from improper escaping in two carousel shortcode implementations. The `wp_json_encode()` function produces JSON-encoded output that is placed directly into single-quoted HTML attributes. Without `esc_attr()` wrapping, an attacker can inject a payload like `'};alert(1);//` to break out of the `data-settings` attribute and execute arbitrary JavaScript. The JSON encoding does not provide sufficient context-aware escaping for HTML attribute contexts, particularly when single quotes are used as attribute delimiters.

Defensive priority

medium

Recommended defensive actions

  • Update WPBakery Page Builder Addons by Livemesh plugin to version 3.9.5 or later if available
  • Review and audit all posts and pages for unauthorized use of `[lvca_carousel]` or `[lvca_posts_carousel]` shortcodes, particularly those containing suspicious single-quote patterns or encoded payloads
  • Implement Content Security Policy (CSP) headers to mitigate impact of any unpatched XSS vectors
  • Restrict Contributor-level access to trusted users only until patching is complete
  • Consider using WordPress security plugins with XSS filtering capabilities as a defense-in-depth measure
  • Review web server access logs for unusual patterns of shortcode usage or encoded payload submissions

Evidence notes

Vulnerability confirmed via Wordfence security advisory and WordPress plugin source code references. CWE-79 (Improper Neutralization of Input During Web Page Generation) identified as primary weakness. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.

Official resources

2026-05-27