Compliance Impact

The vulnerability allows authenticated attackers with Subscriber-level access and above to inject malicious scripts that execute in the context of administrators or site visitors. This can lead to unauthorized modification of plugin settings and potential exposure of sensitive information.

Such unauthorized script execution and potential data exposure could impact compliance with standards like GDPR and HIPAA, which require protection of personal data and secure handling of user information.

However, the provided information does not explicitly detail the compliance implications or specific regulatory impacts.

Useful 0 Not Useful 0

Executive Summary

The WPBakery Page Builder Addons by Livemesh plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in its `lvca_admin_ajax` AJAX action. This vulnerability exists in all versions up to and including 3.9.4 because the plugin does not properly check user permissions and fails to sanitize input sufficiently.

Although the AJAX handler verifies a nonce, it does not verify the user's capabilities, allowing authenticated users with Subscriber-level access or higher to exploit this flaw.

Attackers can modify plugin settings and inject malicious scripts that execute when administrators access the plugin settings page or when any user visits the frontend.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with low-level authenticated access (Subscriber or above) to inject malicious scripts into the plugin settings.

These scripts can execute in the context of administrators visiting the plugin settings page or any user visiting the frontend, potentially leading to unauthorized actions, data theft, or session hijacking.

Because the vulnerability involves Stored Cross-Site Scripting, the malicious code persists and can affect multiple users, increasing the risk and impact.

Useful 0 Not Useful 0