PT-2026-43549 · Livemesh+1 · Livemesh Addons For Beaver Builder+1

Dj + 1 · CVE-2026-3897 · Published 2026-05-26 · Updated 2026-06-04

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Livemesh Addons for Beaver Builder versions prior to 3.9.3

Description Stored Cross-Site Scripting occurs via the labb admin ajax AJAX action due to missing authorization checks and insufficient input sanitization. While the AJAX handler verifies a nonce, it fails to check user capabilities. This allows authenticated attackers with Subscriber-level access or higher to modify plugin settings and inject malicious scripts. These scripts execute when administrators access the plugin settings page or when any user visits the frontend.

Recommendations Update Livemesh Addons for Beaver Builder to version 3.9.3 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3897

Affected Products

Livemesh Addons For Beaver Builder

Addons-For-Beaver-Builder

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-3897 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8bc41c61-1d8a-445f-bd70-3b14a40c89d4?source=cve · Note
• https://plugins.trac.wordpress.org/browser/addons-for-beaver-builder/tags/3.9.2/admin/admin-ajax.php#L64 · Note
• https://reddit.com/r/StopBadBots/comments/1twww49/insane_record_145_wordpress_plugins_exposed_with · Reddit Post
• https://plugins.trac.wordpress.org/browser/addons-for-beaver-builder/tags/3.9.2/includes/helper-functions.php#L248 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3897 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8bc41c61-1d8a-445f-bd70-3b14a40c89d4?source=api-prod · Note
• https://plugins.trac.wordpress.org/browser/addons-for-beaver-builder/tags/3.9.2/admin/views/settings.php#L137 · Note