PT-2026-43543 · Livemesh+1 · Livemesh Wpbakery Page Builder Addons+1

Dj + 1 · CVE-2026-2030 · Published 2026-05-26 · Updated 2026-06-04

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WPBakery Page Builder Addons by Livemesh versions prior to 3.9.5

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Shortcode attributes for [lvca carousel] and [lvca posts carousel] are encoded using wp json encode() and placed into single-quoted data-settings HTML attributes without the use of esc attr(). This allows authenticated attackers with Contributor-level access or higher to inject single quotes to break out of the attribute and execute arbitrary web scripts when a user visits the affected page.

Recommendations Update to a version newer than 3.9.4.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-2030

Affected Products

Livemesh Wpbakery Page Builder Addons

Addons-For-Visual-Composer

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-2030 · Security Note
• https://plugins.trac.wordpress.org/browser/addons-for-visual-composer/tags/3.9.4/includes/addons/posts-carousel/class-lvca-posts-carousel.php#L113 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2030 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ac1493dc-a90a-4427-a631-af5da65e1d6c?source=cve · Note
• https://reddit.com/r/StopBadBots/comments/1twww49/insane_record_145_wordpress_plugins_exposed_with · Reddit Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ac1493dc-a90a-4427-a631-af5da65e1d6c?source=api-prod · Note
• https://plugins.trac.wordpress.org/browser/addons-for-visual-composer/tags/3.9.4/includes/addons/carousel/class-lvca-carousel.php#L55 · Note