CVE-2026-3897: Livemesh Addons Beaver Builder XSS Flaw

CVE-2026-3897 Overview

CVE-2026-3897 is a Stored Cross-Site Scripting (XSS) vulnerability in the Livemesh Addons for Beaver Builder plugin for WordPress, affecting all versions up to and including 3.9.2. The flaw resides in the labb_admin_ajax AJAX action, which verifies a nonce but fails to enforce user capability checks. Authenticated attackers with Subscriber-level access can modify plugin settings and inject malicious scripts. The injected payload executes when administrators access the plugin settings page or when any visitor loads affected frontend pages. The vulnerability is categorized under CWE-862: Missing Authorization.

Critical Impact
Low-privilege authenticated users can persist arbitrary JavaScript in plugin settings, enabling session theft, administrative account takeover, and drive-by attacks against site visitors.

Affected Products

Livemesh Addons for Beaver Builder plugin for WordPress, versions through 3.9.2
WordPress sites with Subscriber-or-higher account registration enabled
Any frontend pages rendering the plugin's configurable output

Discovery Timeline

2026-05-27 - CVE-2026-3897 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-3897

Vulnerability Analysis

The vulnerability stems from a broken access control pattern in the plugin's administrative AJAX handler. The labb_admin_ajax action processes settings updates from authenticated WordPress sessions. While the handler validates a WordPress nonce, it does not invoke current_user_can() or any equivalent capability check before persisting input. Any logged-in user, including Subscribers, can submit crafted requests that overwrite plugin configuration values. Those configuration values are subsequently rendered in admin views and frontend output without adequate output escaping, producing stored XSS.

Root Cause

The root cause is missing authorization combined with insufficient input sanitization. Nonce validation only confirms request origin and freshness. It does not authorize an actor for a privileged operation. Because the plugin treats nonce validation as sufficient, low-privilege users gain write access to settings reserved for administrators. Output rendering routines in settings.php and the helper functions further trust the stored values, leaving injected <script> payloads intact.

Attack Vector

An attacker registers or compromises a Subscriber account on a target WordPress site. The attacker retrieves a valid labb_admin_ajax nonce from any page that exposes it to authenticated users. They then POST a crafted payload to /wp-admin/admin-ajax.php with action=labb_admin_ajax and JavaScript embedded in a settings field. The payload persists in the WordPress options table. Execution occurs in the browser of any administrator who opens the plugin settings page, or any visitor who loads a frontend page that renders the affected setting.

No verified exploitation code is published. Technical details for the vulnerable handler are referenced in the WordPress Plugin Code Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-3897

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with action=labb_admin_ajax originating from Subscriber or Contributor accounts
Unexpected <script>, onerror=, or javascript: strings within Livemesh plugin option rows in the wp_options table
New or modified WordPress user accounts created shortly after suspicious AJAX activity, indicating possible admin takeover
Outbound browser requests from administrator sessions to attacker-controlled domains after visiting the plugin settings page

Detection Strategies

Audit WordPress access logs for admin-ajax.php calls referencing labb_admin_ajax from non-administrator users
Run integrity checks against plugin option values, comparing stored content to expected sanitized markup
Deploy web application firewall rules that block HTML and JavaScript tokens within labb_admin_ajax request bodies
Enable Content Security Policy reporting to surface inline script execution from plugin-rendered pages

Monitoring Recommendations

Alert on creation of WordPress accounts followed by AJAX activity within a short window
Monitor administrative session cookies for use from unfamiliar IP addresses after settings page visits
Track changes to wp_options rows owned by the plugin and flag entries containing HTML control characters

How to Mitigate CVE-2026-3897

Immediate Actions Required

Update Livemesh Addons for Beaver Builder to a release later than 3.9.2 once the vendor publishes a patched version
Audit existing plugin settings for injected script content and restore clean configuration values
Review WordPress user roles and remove unnecessary Subscriber accounts, especially those created from open registration
Rotate administrator credentials and active session tokens if suspicious AJAX activity is identified

Patch Information

A fixed version had not been confirmed in the referenced advisories at the time of publication. Monitor the Wordfence Vulnerability Report and the plugin page on WordPress.org for an official update beyond version 3.9.2.

Workarounds

Disable the Livemesh Addons for Beaver Builder plugin until a patched release is available
Disable WordPress open user registration or restrict it to vetted accounts
Apply a WAF rule to block action=labb_admin_ajax requests originating from sessions without manage_options capability
Enforce a strict Content Security Policy that disallows inline scripts on administrative pages

bash

# Example WordPress CLI workflow to deactivate the vulnerable plugin
wp plugin deactivate addons-for-beaver-builder
wp option get widget_labb_settings
wp option delete widget_labb_settings