CVE-2026-57754: Livemesh Addons XSS Vulnerability (CVSS 6.5) – Patch Guide

Technical summary

CVE-2026-57754 is a Stored XSS vulnerability (CWE-79) in Livemesh Addons for WPBakery Page Builder versions up to and including 3.9.4. The vulnerability arises from insufficient input sanitization or output encoding in the plugin's handling of contributor-supplied data. An authenticated attacker with contributor-level privileges can craft malicious payloads that persist in the database and execute when the page is rendered for higher-privileged users. The attack vector is network-based with low attack complexity, requiring user interaction (a site admin viewing the malicious content) to trigger the XSS. The vulnerability scores a CVSS 3.1 score of 6.5 (MEDIUM) with impact across confidentiality, integrity, and availability due to the potential for session hijacking, credential theft, or further site compromise.

Business impact

For WordPress sites using Livemesh Addons for WPBakery, this vulnerability allows unauthorized data exfiltration (reading sensitive page content or admin cookies), unauthorized modifications (injecting further malicious content or redirects), and potential denial of service. If an attacker gains contributor access—through credential compromise, social engineering, or plugin vulnerabilities—they can compromise administrative sessions, install backdoors, or deface the site. Sites with loose contributor permissions or shared authoring workflows are at higher risk.

Affected systems

The vulnerability affects Livemesh Addons for WPBakery Page Builder versions 3.9.4 and earlier. Any WordPress installation using this plugin version range with active contributor accounts is potentially exposed. The plugin must be active on the site for the vulnerability to be exploitable.

Exploitability

Exploitation requires an authenticated account with at least contributor-level permissions on the WordPress site. No zero-day capability or public exploit code is currently tracked in the KEV catalog. Attack complexity is low—the attacker simply needs to craft and submit XSS payloads through the plugin's input fields during page creation or editing. User interaction is required (an admin or higher-privileged user must view the malicious page) for the payload to execute. Organizations with weak access controls, shared hosting, or compromised contributor accounts face elevated risk.

Remediation

Update Livemesh Addons for WPBakery Page Builder to a patched version released after 3.9.4. Verify the exact patched version against the Livemesh plugin repository or vendor advisory, as version numbering may vary. Until patching is complete, restrict contributor and author permissions to trusted users only, use a Web Application Firewall (WAF) to block or sanitize suspicious script injections, and monitor database audit logs for unauthorized page modifications.

Patch guidance

Check the Livemesh plugin marketplace or GitHub repository for release notes confirming that your target version addresses CVE-2026-57754. Update the plugin through the WordPress admin dashboard (Plugins > Updates) or manually upload the patched version. After updating, verify the plugin version number in Installed Plugins and test page creation/editing workflows to ensure functionality is not disrupted. If your version appears to be recent, also verify that your WordPress core and WPBakery Page Builder are fully up-to-date, as interactions between plugins can introduce or mask vulnerabilities.

Detection guidance

Monitor Web Application Firewall (WAF) and WordPress security logs for POST requests to the page builder with unusual or encoded payloads (e.g., <script>, javascript:, onerror=). Use WordPress security plugins (e.g., Wordfence, Sucuri) to audit contributor activity and flag suspicious page revisions. In the database, search the wp_posts and wp_postmeta tables for suspicious script tags or event handlers in post content and meta fields. Review access logs for contributors accessing the page builder more frequently than normal. Implement file integrity monitoring to detect unauthorized changes to plugin files.

Why prioritize this

While the CVSS score of 6.5 is MEDIUM, this vulnerability warrants prompt attention because (1) it exploits a common plugin in WordPress page-building workflows, (2) it enables privilege escalation from contributor to admin session compromise, and (3) stored XSS is particularly dangerous—payloads persist and affect multiple users. Organizations with high-trust contributor ecosystems (agencies, SaaS platforms, news outlets with multiple authors) should prioritize patching. The absence of active exploitation in the KEV catalog provides a brief window to patch before widespread attacks.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects a network-based attack requiring low complexity and authentication at the contributor level. The scope is changed (C), meaning the vulnerability can affect resources beyond the security scope of the vulnerable component (e.g., admin sessions). Confidentiality, Integrity, and Availability are all rated Low impact, as the attacker can read/modify page content and potentially disrupt the editing experience, but cannot achieve full system compromise or data destruction from XSS alone. The score is not higher because exploitation requires both an authenticated account and user interaction. In practice, the risk is often higher than CVSS suggests if contributor accounts are loosely managed or if the site hosts sensitive content.

Frequently asked questions