CVE-2026-3897

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the Livemesh Addons for Beaver Builder plugin for WordPress, versions up to and including 3.9.2. The labb_admin_ajax AJAX action, defined in admin/admin-ajax.php, handles plugin settings saving but fails to perform a capability check after verifying a nonce [1], [2]. This allows any authenticated user with a valid nonce to modify plugin settings, including fields that are later output unsanitized on the plugin settings page and potentially on the frontend. The affected code path is reachable when an attacker knows or can obtain the nonce value (e.g., from a page rendered to subscribers).

Exploitation

An attacker must be an authenticated WordPress user with Subscriber-level access or higher. The attacker crafts a POST request to wp-admin/admin-ajax.php with the action=labb_admin_ajax parameter, a valid nonce (typically extracted from the plugin's admin page), and malicious JavaScript payloads in settings fields such as color or text inputs. The AJAX handler invokes labb_save_settings without checking the user's capability (e.g., manage_options), so the payload is persisted. No additional privileges or user interaction beyond being authenticated is required.

Impact

If an administrator visits the plugin settings page, the injected script executes in the context of the admin session, leading to full compromise. Additionally, any frontend page that displays these settings (e.g., styled outputs) may also execute the script for other visitors. This can result in session hijacking, defacement, or the injection of administrative actions.

Mitigation

The developer has not yet released a patched version. Available references do not mention a fixed version or release date [1], [2], [3]. As a workaround, site administrators can restrict access to the plugin settings page for untrusted users by applying custom role capabilities or using a Web Application Firewall rules. The plugin vendor should implement a capability check (e.g., current_user_can('manage_options')) in the AJAX callback.