PT-2026-22092 · WordPress+1 · Livemesh Addons For Beaver Builder+1

Dj + 1 · Published 2026-02-26 · Updated 2026-02-26 · CVE-2026-2029

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Livemesh Addons for Beaver Builder versions up to and including 3.9.2

Description The Livemesh Addons for Beaver Builder plugin for WordPress contains a Stored Cross-Site Scripting issue. The issue is due to insufficient input sanitization and output escaping in the [labb pricing item] shortcode’s title and value attributes. The plugin uses htmlspecialchars decode() after wp kses post(), which re-encodes HTML entities into executable code after sanitization. This allows authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. These scripts will then execute when a user accesses the compromised page.

Recommendations Update Livemesh Addons for Beaver Builder to a version beyond 3.9.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-2029

Affected Products

Beaver Builder

Livemesh Addons For Beaver Builder

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-2029 · Security Note
• https://twitter.com/VulmonFeeds/status/2026949946767770108 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/8bc96b4f-256e-491b-9d27-de1adbf67643?source=cve · Note
• https://plugins.trac.wordpress.org/browser/addons-for-beaver-builder/tags/3.9.2/includes/modules/labb-pricing-table/labb-pricing-table.php#L51 · Note
• https://t.me/CVEtracker/45815 · Telegram Post
• https://plugins.trac.wordpress.org/browser/addons-for-beaver-builder/tags/3.9.2/includes/modules/labb-pricing-table/labb-pricing-table.php#L59 · Note
• https://twitter.com/CVEnew/status/2027004220876927139 · Twitter Post