CVE-2026-2029 is a stored cross-site scripting vulnerability in the Livemesh Addons for Beaver Builder WordPress plugin. The issue arises from insufficient input sanitization and output escaping in the [labb_pricing_item] shortcode's title and value attributes. The plugin applies wp_kses_post() to sanitize input but then uses htmlspecialchars_decode(), which reverses the sanitization by decoding HTML entities back into executable code. This flaw enables authenticated users with Contributor-level privileges or higher to inject arbitrary scripts that execute in the context of any user viewing the compromised page.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who visit the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity of user sessions and data within the affected WordPress site.

No official patch or fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Livemesh Addons for Beaver Builder plugin if possible. Monitor vendor channels for updates and apply any official patches promptly once released.