CVE-2026-3896
Stored XSS in Livemesh SiteOrigin Widgets WordPress Plugin
Publication date: 2026-05-27
Last updated on: 2026-05-27
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| livemesh | siteorigin_widgets | to 3.9.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Livemesh SiteOrigin Widgets plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in its `lsow_admin_ajax` AJAX action. This vulnerability exists in all versions up to and including 3.9.2 because the plugin lacks proper authorization checks and does not sufficiently sanitize input.
Although the AJAX handler verifies a nonce, it fails to check user capabilities, allowing authenticated users with Subscriber-level access or higher to exploit this flaw.
Attackers can modify plugin settings and inject malicious scripts that execute when administrators view the plugin settings page or when any user visits the frontend.
How can this vulnerability impact me? :
This vulnerability allows attackers with low-level authenticated access (Subscriber or above) to inject malicious scripts into the plugin settings.
These scripts can execute in the context of administrators or any site visitors, potentially leading to unauthorized actions, data theft, or site compromise.
Because the attack can be performed remotely over the network (AV:N) with low attack complexity (AC:L) and requires only low privileges (PR:L), it poses a significant security risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated attackers with Subscriber-level access and above to inject malicious scripts that execute in the context of administrators or users visiting the site. This can lead to unauthorized modification of plugin settings and potential exposure of sensitive data.
Such unauthorized access and potential data exposure could negatively impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal data and prevention of unauthorized access.
However, the provided information does not explicitly detail the compliance impact or specific regulatory consequences.