CVE-2026-24594: Livemesh Addons WPBakery XSS Vulnerability

CVE-2026-24594 Overview

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Livemesh Addons for WPBakery Page Builder WordPress plugin. This vulnerability (CWE-79) allows attackers with high privileges to inject malicious scripts that persist in the application and execute when other users view the affected pages. The vulnerability stems from improper neutralization of user input during web page generation.

Critical Impact

Authenticated attackers with administrative privileges can inject persistent malicious scripts that execute in the browsers of site visitors and administrators, potentially leading to session hijacking, credential theft, and unauthorized administrative actions.

Affected Products

• Livemesh Addons for WPBakery Page Builder (addons-for-visual-composer) versions through 3.9.4
• WordPress websites utilizing the vulnerable plugin versions
• WPBakery Page Builder installations with the Livemesh Addons extension

Discovery Timeline

• 2026-01-23 - CVE CVE-2026-24594 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2026-24594

Vulnerability Analysis

This Stored XSS vulnerability exists due to improper input sanitization within the Livemesh Addons for WPBakery Page Builder plugin. When user-supplied data is processed by the plugin, insufficient validation allows malicious JavaScript code to be stored in the application database and subsequently rendered to users viewing the affected content.

The vulnerability requires an authenticated user with high privileges to exploit, but the impact extends beyond the attacker's session. Once injected, the malicious payload persists and executes whenever other users—including administrators—view the compromised page elements. This cross-session execution capability (indicated by the changed scope in the vulnerability assessment) makes this particularly dangerous for multi-user WordPress installations.

Root Cause

The root cause lies in the plugin's failure to properly sanitize and escape user-provided input before storing it in the database and rendering it in HTML output. The Livemesh Addons plugin processes various content fields for WPBakery Page Builder elements without adequate neutralization of potentially dangerous HTML and JavaScript content. This allows specially crafted input containing script tags or event handlers to bypass intended content restrictions and execute arbitrary JavaScript in the context of the victim's browser session.

Attack Vector

The attack is network-accessible and requires the attacker to have high-level privileges (administrator or editor role) on the WordPress site. The exploitation also requires some form of user interaction—a victim must navigate to a page containing the malicious payload for the XSS to trigger.

An attacker would typically:

1. Authenticate to the WordPress dashboard with sufficient privileges
2. Access a page or post utilizing WPBakery Page Builder with Livemesh Addons
3. Insert malicious JavaScript code into a vulnerable input field within a Livemesh addon element
4. Save the content, which stores the unescaped payload in the database
5. When any user visits the page containing the malicious element, the stored script executes in their browser context

The vulnerability can be leveraged to steal session cookies, redirect users to phishing sites, perform actions on behalf of authenticated users, or inject additional malicious content.

Detection Methods for CVE-2026-24594

Indicators of Compromise

• Unexpected JavaScript code or suspicious <script> tags within WPBakery Page Builder content blocks in the WordPress database
• Unusual entries in the wp_posts or wp_postmeta tables containing encoded or obfuscated script payloads
• Browser developer console errors indicating blocked or flagged script execution from page builder elements
• User reports of unexpected browser behavior, redirects, or pop-ups when viewing specific pages

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and block inline script execution from unexpected sources
• Deploy Web Application Firewall (WAF) rules to monitor and alert on XSS payload patterns in POST requests to WordPress admin endpoints
• Conduct regular database audits scanning for common XSS patterns in plugin-related content tables
• Enable WordPress audit logging to track changes to posts and pages by privileged users

Monitoring Recommendations

• Monitor WordPress admin activity logs for unusual content modifications to pages using WPBakery Page Builder
• Implement real-time alerting for patterns indicative of XSS payloads in HTTP request bodies
• Review access logs for pages built with Livemesh Addons to identify potential payload testing or exploitation attempts
• Deploy browser-based security monitoring to detect client-side script injection anomalies

How to Mitigate CVE-2026-24594

Immediate Actions Required

• Update Livemesh Addons for WPBakery Page Builder to a version newer than 3.9.4 when a patched release becomes available
• Audit existing page content created with Livemesh Addons for suspicious or unexpected script content
• Restrict administrative and editor privileges to trusted users only
• Implement a Web Application Firewall (WAF) with XSS filtering rules as a temporary protective measure

Patch Information

The vulnerability affects Livemesh Addons for WPBakery Page Builder through version 3.9.4. Site administrators should monitor the Patchstack Vulnerability Report and the official WordPress plugin repository for security updates from the Livemesh vendor. Apply the latest available patch as soon as it is released.

Workarounds

• Temporarily disable the Livemesh Addons for WPBakery Page Builder plugin if it is not critical to site operations until a patched version is available
• Implement strict Content Security Policy (CSP) headers to limit script execution to trusted sources only
• Apply input validation and output encoding at the server level using security plugins such as Wordfence or Sucuri
• Limit user roles with access to WPBakery Page Builder editing capabilities to reduce the attack surface

# Example: Add Content Security Policy header in .htaccess (Apache)
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"
</IfModule>