Livemesh SiteOrigin Widgets <= 3.9.2 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The Livemesh SiteOrigin Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `lsow_admin_ajax` AJAX action in all versions up to, and including, 3.9.2 due to missing authorization checks and insufficient input sanitization. The AJAX handler verifies a nonce but does not check user capabilities. This makes it possible for authenticated attackers with Subscriber-level access and above to modify plugin settings and inject malicious scripts that execute when administrators access the plugin settings page or when any user visits the frontend.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-3896
- 2026-10-03 Alias added: GHSA-6jw7-72vv-cg3r
References
Other 4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a1510984-571b-49ce-9e10-129e2a1aca7b?source=cve
- https://plugins.trac.wordpress.org/browser/livemesh-siteorigin-widgets/tags/3.9.2/admin/admin-ajax.php#L65
- https://plugins.trac.wordpress.org/browser/livemesh-siteorigin-widgets/tags/3.9.2/includes/helper-functions.php#L235
- https://plugins.trac.wordpress.org/browser/livemesh-siteorigin-widgets/tags/3.9.2/admin/views/settings.php#L107
More livemesh vulnerabilities
- TI-2026-01306 Livemesh Addons by Elementor <= 9.0 - Authenticated (Contributor+) Local File Inclusion via Widget Template Parameter CVSS 3.1HIGH 8.8
- TI-2024-02216 Elementor Addons by Livemesh <= 8.4 - Authenticated (Contributor+) Limited Local File Inclusion via Widgets CVSS 3.1HIGH 8.8
- TI-2024-25047 WordPress Elementor Addons by Livemesh plugin <= 8.4.0 - Local File Inclusion vulnerability CVSS 3.1MEDIUM 6.5
- TI-2024-19929 WordPress WPBakery Page Builder Addons by Livemesh plugin <= 3.7 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
- TI-2024-18587 WordPress Livemesh Addons for Elementor Plugin <= 8.3.5 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 6.5
- TI-2024-16826 WordPress Elementor Addons by Livemesh plugin <= 8.3 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-3896 · CVE Program
- CVE-2026-3896 · NVD
- FIRST EPSS
- GHSA-6jw7-72vv-cg3r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences